ClickFix: The Fake CAPTCHA Trap

Before investigating the telemetry, understand HOW the attacker got their command to run. ClickFix never delivers a file the browser can block, so the command has to reach the Run dialog some other way. The endpoint agent recorded the page doing it. Read the telemetry below and name the Windows facility the page wrote the command into.

You understand the ClickFix lure; now move to the endpoint. After the PowerShell command ran, the XDR file monitor on corp-wks-102 captured a burst of file activity, and one of those files is the malicious library that regasm.exe loaded into memory. Most entries are normal Windows and Office noise. Which file is the attacker's library?

You have the malicious library; now find where it came from. The ClickFix PowerShell command pulled l6E.exe down from an external host before regasm.exe ever touched it. A domain name alone is not enough for a firewall block or a hunt across other hosts: you need the IP it resolved to. Review the SIEM network logs from corp-wks-102 and identify the server that delivered the payload.

You know how the malware arrived and what it loaded. Now find where the stolen data went. After cleanuploader.exe read Anita's Chrome credential store, it opened an outbound channel that tries to look like normal Microsoft cloud traffic. Use the XDR process tree to place that process in the chain, then work the firewall logs to expose the true destination behind the disguise.

You have reconstructed the entire ClickFix chain: lure, execution, the loaded library, the payload source, and the live C2 channel. The workstation is still online, still talking to the attacker, and carries a persistence key that will relaunch the malware. Review the summary and the persistence finding, then make the call: of the five containment actions offered, which one should you take FIRST?