ClickFix makes its way into Russia

How adversaries leverage fake CAPTCHAs to deploy Octowave Loader and a previously unknown RAT

Command code	Description
1	Download from the C2 provided link an EXE file, save it under an arbitrary name [a-z]{20}\.exe to the %TEMP% directory, run the downloaded file using ShellExecuteW("open", <filePath>).
2	Obtain DLL run parameters from the PowerShell link, use the C2 provided link to download a DLL file and save it under an arbitrary name [a-z]{20}\.dll to the %TEMP% directory, run the downloaded file using ShellExecuteW("open") and rundll32.exe. Thus creating a string: %WINDIR%\System32\rundll32.exe <dllPath>,<Params>.
3	Use the C2 provided link to download a DDL file and save it under an arbitrary name [a-z]{20}\.dll to the %TEMP% directory, run the downloaded file using ShellExecuteW("open") and regsvr32.exe. Thus creating a string: %WINDIR%\System32\regsvr32.exe /s .
4	The function does nothing, returns the value 1. Either the adversaries failed to implement the command execution logic, or they use this command as a ping/heartbeat, which always returns 1.

Tactic	Technique	Procedure
Initial Access	Phishing	The adversaries distribute malicious PDF documents via phishing emails
Execution	Command and Scripting Interpreter: PowerShell	The adversaries use PowerShell commands to download and run malicious code
	Native API	The adversaries leverage an unclassified remote access trojan to run C2 provided executable files using ShellExecuteW("open")
	User Execution: Malicious Link	The adversaries attempt to trick the user into clicking the link in the PDF document and going through a fake CAPTCHA
	User Execution: Malicious File	The user has to run the malicious PDF document with a fake CAPTCHA and redirect themselves to the attackers’ website via an embedded link
	User Execution: Malicious Copy and Paste	The adversaries attempt to trick the victim into executing a malicious PowerShell command using the following actions: Win+R -> Ctrl+V -> Enter
Persistence	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	The adversaries leverage Octowave Loader to gain persistence using the Run registry key
	Scheduled Task/Job: Scheduled Task	The adversaries leverage Octowave Loader to gain persistence by creating tasks in Windows Task Scheduler
Defense Evasion	Deobfuscate/Decode Files or Information	The adversaries load a malicious Octowave Loader DLL to decrypt from a WAV file a shellcode, which then decrypts and runs the Octowave Loader EXE component. The adversaries decrypt the encrypted Octowave Loader config file to obtain the final payload
	Hijack Execution Flow: DLL	The adversaries employ DLL side-loading to launch the malicious Octowave Loader DLL using a legitimate executable file (AGF3DPrinterDriver.exe, CoreSync.exe)
	Obfuscated Files or Information	The adversaries use stack-generated strings in the unclassified RAT
	Obfuscated Files or Information: Steganography	The adversaries use PNG files to store the Octowave Loader executable. The adversaries use WAV files to store shellcodes and Octowave Loader executable component
	Obfuscated Files or Information: Dynamic API Resolution	The adversaries use MurmurHash3 to hash function names in the unclassified RAT
	Obfuscated Files or Information: Encrypted/Encoded File	The adversaries store the final payload in an encrypted Octowave Loader config file
Discovery	Process Discovery	The adversaries use the unclassified RAT to obtain the name of the process in which the malware is executed
	System Information Discovery	The adversaries use the unclassified RAT to obtain the name of the system domain, Windows OS version, architecture
	System Owner/User Discovery	The adversaries use the unclassified RAT to obtain username, computer name, user permissions
Command and Control	Application Layer Protocol: Web Protocols	The adversaries use the unclassified RAT which transmits the collected system data in encrypted form via an HTTP POST request
	Encrypted Channel: Symmetric Cryptography	The adversaries use ChaCha20 to encrypt C2 commands in the unclassified RAT
	Ingress Tool Transfer	The adversaries use the unclassified RAT to load and run executables from the C2 server

#attacks

#research

#phishing