Input: Palo Alto Networks customers are protected by attacks discussed in this blog by:  All delivery documents and payloads discussed are detected with malicious verdicts in WildFire Traps blocks the macro laden documents as Suspicious macro detected  C2 URLs have been classified as Command and Control AutoFocus customers may learn more via the Zebrocy and Cannon tags  Indicators of Compromise Delivery Hashes 2cfc4b3686511f959f14889d26d3d9a0d06e27ee2bb54c9afb1ada6b8205c55f c20e5d56b35992fe74e92aebb09c40a9ec4f3d9b3c2a01efbe761fa7921dd97f abfc14f7f708f662046bfcad81a719c71a35a8dc5aa111407c2c93496e52db74 40318f3593bca859673827b88d65c5d2f0d80a76948be936a60bda67dff27be9 5749eb9d7b8afa278be24a4db66f122aeb323eaa73a9c9e52d77ac3952da5e7d af77e845f1b0a3ae32cb5cfa53ff22cc9dae883f05200e18ad8e10d7a8106392 34bdb5b364358a07f598da4d26b30bac37e139a7dc2b9914debb3a16311f3ded 79bd5f34867229176869572a027bd601bd8c0bc3f56d37443d403a6d1819a7e5 77ff53211bd994293400cb3f93e3d3df6754d8d477cb76f52221704adebad83a Remote Template Hashes f1e2bceae81ccd54777f7862c616f22b581b47e0dda5cb02d0a722168ef194a5 86bb3b00bcd4878b081e4e4f126bba321b81a17e544d54377a0f590f95209e46 2da5a388b891e42df4ed62cffbc167db2021e2441e6075d651ecc1d0ffd32ec8 0d7b945b9c912d205974f44e3742c696b5038c2120ed4775710ed6d51fbc58ef fc69fb278e12fc7f9c49a020eff9f84c58b71e680a9e18f78d4e6540693f557d ed8f52cdfc5f4c4be95a6b2e935661e00b50324bee5fe8974599743ccfd8daba b9f3af84a69cd39e2e10a86207f8612dd2839873c5839af533ffbc45fc56f809 Remote Template URLs hxxp://188.241.58[.]170/live/owa/office.dotm hxxp://185.203.118[.]198/documents/Note_template.dotm hxxp://185.203.118[.]198/documents/Note_template.dotm hxxp://145.249.105[.]165/doc/temp/release.dotm hxxp://145.249.105[.]165/messages/content/message_template.dotm hxxp://188.241.58[.]170/version/in/documents.dotm hxxp://109.248.148[.]42/officeDocument/2006/relationships/templates.dotm hxxp://109.248.148[.]42/office/thememl/2012/main/attachedTemplate.dotm hxxp://109.248.148[.]42/office/thememl/2012/main/attachedTemplate.dotm Zebrocy Hashes 5173721f3054b92e6c0ff2a6a80e4741aa3639bc1906d8b615c3b014a7a1a8d7 61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e 6ad3eb8b5622145a70bec67b3d14868a1c13864864afd651fe70689c95b1399a 9a0f00469d67bdb60f542fabb42e8d3a90c214b82f021ac6719c7f30e69ff0b9 b41480d685a961ed033b932d9c363c2a08ad60af1d2b46d4f78b5469dc5d58e3 c91843a69dcf3fdad0dac1b2f0139d1bb072787a1cfcf7b6e34a96bc3c081d65 e5aece694d740ebcb107921e890cccc5d7e8f42471f1c4ce108ecb5170ea1e92 Zebrocy C2 URLs hxxp://188.241.58[.]170/local/s3/filters.php hxxp://185.203.118[.]198/en_action_device/center_correct_customer/drivers-i7-x86.php hxxp://145.249.105[.]165/resource-store/stockroom-center-service/check.php hxxp://109.248.148[.]42/agr-enum/progress-inform/cube.php Cannon Hashes 861b6bc1f9869017c48930af5848930dd037fb70fc506d8a7e43e1a0dbd1e8cb 4405cfbf28e0dfafa9ea292e494f385592383d2476a9c49d12596b8d22a63c47 174effcdeec0b84c67d7dc23351418f6fa4825550d595344214cc746f1a01c1a a23261e2b693750a7009569df96ec4cf61e57acc9424c98d6fe1087ff8c659ce 651d5aab82e53711563ce074c047cbaa0703931673fa3ad20933d6a63c5c3b12 68df0f924ce79765573156eabffee3a7bb0fa972d2b67d12dd91dea3ec255d24 61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e 5a02d4e5f6d6a89ad41554295114506540f0876e7288464e4a70c9ba51d24f12 d06be83a408f4796616b1c446e3637009d7691c131d121eb165c55bdd5ba50b4 78adc8e5e4e86146317420fa3b2274c9805f6942c9973963467479cb1bbd4ead 054c5aa73d6b6d293170785a82453446429c0efc742df75979b760682ac3026b cac630c11c4bf6363c067fbf7741eae0ec70238d9c5e60d41f3ed8f65b56c1d1 ecc5805898e037c2ef9bc52ea6c6e59b537984f84c3d680c8436c6a38bdecdf4 215f7c08c2e3ef5835c7ebc9a329b04b8d5215773b7ebfc9fd755d93451ce1ae Cannon Related Emails sym777.g[at]post.cz kae.mezhnosh[at]post.cz vebek.morozh30[at]post.cz g0r7tsa45s[at]post.cz marvel.polezha[at]post.cz sahro.bella7[at]post.cz trala.cosh2[at]post.cz Bishtr.cam47[at]post.cz Lobrek.chizh[at]post.cz Cervot.woprov[at]post.cz heatlth500[at]ambcomission[.]com trash023[at]ambcomission[.]com trasler22[at]ambcomission[.]com rishit333[at]ambcomission[.]com tomasso25[at]ambcomission[.]com kevin30[at]ambcomission[.]com

Tactics: TA0001, TA0011
Techniques: T1071, T1566.003, T1566, T1566.002, T1566.001, T1008