6/14/18 rishit333@ambcomission[.]com tomasso25@ambcomission[.]com kevin30@ambcomission[.]com    Table 6 Gathered Delphi Cannon Samples The compilation times in Table 6 suggests that the Delphi variant of Cannon predates the originally reported version, as the first known Delphi sample was compiled in January 2018 and the first known Cannon sample was compiled in April 2018 This actor controlled domain links to a larger Sofacy infrastructure as reported by ThreatConnect While not an exact match, Figure 9 shows these similar header strings and strengthens our hypothesis that the two variants are indeed related:  Figure 9 Similarities of Delphi Cannon and Cannon As seen in Table 6, one of the Delphi Cannon samples (SHA256: cac630c11c..) does not have any associated email addresses, as the sample does not seem to have any C2 functionality Instead, this sample reads “tasks” from a file named ta.bin that another unknown tool then must write to and handle C2 functionality It is also interesting that this specific sample has the same resource name (L30) that contains the same encrypted email addresses as the other samples in Table 6 using heatlth500@ambcomission[.]com as a C2 email (such as ecc5805898..) but does not contain any code to access the resource or decrypt its contents VB.NET Zebrocy Variant The VB.NET variant (SHA256: e5aece694d..) is very similar to other known Zebrocy variants It includes the storage volume serial number within the URL it uses as its C2 beacon, which it obtains using the Scripting.FileSystemObject object to call GetDriveName from the path stored in Environment.SpecialFolder.LocalApplicationData It then uses the storage volume obtained from the GetDriveName function and calls GetDrive to get the SerialNumber of the storage device Like other Zebrocy tools, the C# variant gathers the storage volume serial number to use in outbound beacons to the C2 server In this particular variant, the tool uses the Windows API function GetVolumeInformation to get the serial number of the C: drive This variant of Zebrocy also takes a screenshot that it will transmit to the C2 server in JPEG format We observed them carrying out attacks via spear-phishing emails in late October through November, often leveraging current events within filenames to entice recipients to open the malicious attachments The group continues to develop new variations of Zebrocy by adding a VB.NET and C# version, and it appears that they also have used different variants of the Cannon tool in past attack campaigns
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: 6/14/18 rishit333@ambcomission[.]com tomasso25@ambcomission[.]com kevin30@ambcomission[.]com    Table 6 Gathered Delphi Cannon Samples The compilation times in Table 6 suggests that the Delphi variant of Cannon predates the originally reported version, as the first known Delphi sample was compiled in January 2018 and the first known Cannon sample was compiled in April 2018 This actor controlled domain links to a larger Sofacy infrastructure as reported by ThreatConnect While not an exact match, Figure 9 shows these similar header strings and strengthens our hypothesis that the two variants are indeed related:  Figure 9 Similarities of Delphi Cannon and Cannon As seen in Table 6, one of the Delphi Cannon samples (SHA256: cac630c11c..) does not have any associated email addresses, as the sample does not seem to have any C2 functionality Instead, this sample reads “tasks” from a file named ta.bin that another unknown tool then must write to and handle C2 functionality It is also interesting that this specific sample has the same resource name (L30) that contains the same encrypted email addresses as the other samples in Table 6 using heatlth500@ambcomission[.]com as a C2 email (such as ecc5805898..) but does not contain any code to access the resource or decrypt its contents VB.NET Zebrocy Variant The VB.NET variant (SHA256: e5aece694d..) is very similar to other known Zebrocy variants It includes the storage volume serial number within the URL it uses as its C2 beacon, which it obtains using the Scripting.FileSystemObject object to call GetDriveName from the path stored in Environment.SpecialFolder.LocalApplicationData It then uses the storage volume obtained from the GetDriveName function and calls GetDrive to get the SerialNumber of the storage device Like other Zebrocy tools, the C# variant gathers the storage volume serial number to use in outbound beacons to the C2 server In this particular variant, the tool uses the Windows API function GetVolumeInformation to get the serial number of the C: drive This variant of Zebrocy also takes a screenshot that it will transmit to the C2 server in JPEG format We observed them carrying out attacks via spear-phishing emails in late October through November, often leveraging current events within filenames to entice recipients to open the malicious attachments The group continues to develop new variations of Zebrocy by adding a VB.NET and C# version, and it appears that they also have used different variants of the Cannon tool in past attack campaigns ### Response: .