My Browser Cache Got Infected

Want a new novel Clickfix structure and lore that I haven't seen before? Yes, please. Shout out and thank you to Jerry Blanks for the tip on this one, sharing it, and send it over to me. I'm online at this website, but it's got this annoying manage consent banner. So, I click accept, and there is a verify your human CloudFlare turnstyle. Except it's not a real Cloudflare turn style or I'm not a robot verification. It is a clickfix lure. Ah, let us know you're human. Please complete the steps below. Press the Windows key and R. Press Ctrl +V and press enter. This is a lie. It's a scam. It's social engineering. We would not want to press the Windows key and R on the keyboard and press Ctrl +V on the keyboard and then press enter because we would then be executing that malware. Now, folks are probably pretty familiar with ClickFix because we've covered it a ton on this channel. We've seen it all over the place for cyber crime, malware, info stealer, malware logs, ransomware, apt activity, whatever the heck you want, but take a look at this payload here. This one is a little bit more clever and cutesy than I think we're used to. I haven't seen this often before. I don't know if anyone else has, but look at the trick here. They use cmd.exe. So, ola command prompt, right? cmd.exe/ C to add the argument for a command to run. and they use a for loop looking through Firefox profiles, a directory based out of my environment variable for local app data, like local application data on your Windows computer. And they loop through every single file and then they do check with an if conditional if this percent kill ZF is equal to 17,635. If it hits if that condition is met, then it copies that file percent indicator to wrap that variable. into a temporary directory called t.bat. They don't display any of it, but then they actually go ahead and execute that temp.batch script. Now, let's say I opened up a different web browser. Let's say I went to Google Chrome. How about that? Let me jump back to the same website. Same sort of lore. Clicking honestly anywhere on this page is what would trigger that capture popup. Same exact pretense, but what is in my clipboard now? Let's add it underneath Firefox. Ah, local app data, Google Chrome, user data. Let me try one more. We know the gimmick here. Just clicking anywhere pops this thing up. And that would preload and poison into your clipboard the payload. What does the syntax look like for Brave? Ah, exact same kind of setup, but looking now in the Brave data. Do you see what this is doing here? across each of these web browsers, whatever variant, they're actually caching whatever the next stage payload would be as some Windows batch script, but then the oneliner that you would paste into the run dialogue box actually copies out or grabs that payload from what would already be smuggled onto the file system. We can take a closer look at this back on the website. And if we hit just F12 on our keyboard or open up the browser developer tools, we can take a look in the network tab. And it looks like there's making a lot of communications to a separate cloudrecycle.com. And if I were to click and trigger here, you can see it's reaching another file called H uh where they post a request to it. And let me expand this out just a smidge here. You could actually see in a couple of the requests and responses that post data actually includes our user agent. Like it's trying to determine, okay, what browser are we using? So what is the payload that should be served? This unfortunately is a compromised website now serving these malicious clickfix payloads pertinent to your web browser and then already smuggling a payload via your web browser's cache. So we could take any one of these. Let me go look at Google Chrome and let's say we went to go look at that user data cache in my local app data directory. There's a handful of stuff in here, but we'd probably expect maybe the default profile to include a lot of this in the cache location. And we're trying to find in some of the cache data, is there anything that matches the criteria of a percent till day ZF equal to 17,635? What the heck is percent till day ZF? Well, we can do our homework here. Just a quick little Google search. Uh, let's see what the AI overlords are saying. Nope, not a Nikon mirrorless camera. Don't need that. In Windows batch files, percent till day ZF is a representation of the file size. Oh, okay. So, we're trying to find like however many bytes. Okay, 17 kilobytes maybe. Do we have anything inside of our cache data that kind of at least looks close to it? Uh, here's one. Maybe 18K. Round it up. Oh, 17.2. You can see it down at the very bottom left. So, if I take a look at the properties here. Yeah. Yeah, that size lines up. So that should be cache data from your web browser. That is a batch payload. Let me move these side by side so I can drag this into Sublime Text. And yeah. All right. There is our next stage payload. By the way, something else that you could do here if you weren't willing to drill down all the way into the cache data. You could just start from the user data directory that it presented to you uh inside of the original payload script. So, if I were to drag in that entire folder, what I like to then do is honestly just control shift F to find across all files here. If we're assuming this is going to be batch, what's probably the most likely indicator in a batch script? Probably at echo off. So, if I just do a find all for that, we see it right here in the exact file that we just kind of found by hand. So, now we can start to be a little bit curious. What is this next stage payload doing? Hey, super quick before we keep falling down the rabbit hole any further. Please let me take just a moment to tell you about the sponsor of today's video, Keeper Security. Hackers don't always need a password to break in. They don't need to target a person or any human being at all. Today, one of the biggest risks to your security is nonhuman identities. And you guessed it, AI agents running around. There are hundreds more non-human identities than there are human users. and most of them have credentialed access and zero oversight. But Keeper Security can protect your organization with their zero trust identity security platform that's used by over 95,000 enterprises and millions of users. They discover identities in the cloud and lock them into their vault and they enforce just in time access with monitored sessions and auto rotated credentials. So, Keeper eliminates standing privilege, and Keeper's endpoint solution catches AI agents in the act. If either a human or an agent tries to access or do something it shouldn't, Keeper can intercept and terminate the session right away. All while giving you the visibility and centralized management, easily integrating with the tools you already use. Whether it's Slack, Teams, Jira, Service Now, or any other DevOps tool you have in your stack, you don't have to change your workflow. Start protecting your organization from not just human identities, but nonhuman identities. You can get started with Keeper completely for free with a 14-day trial with my link below in the video description, jh.live/keeper. Huge thanks to Keeper for sponsoring this video. So, now we can start to be a little bit curious. What is this next stage payload doing? Setting the title to Cloudflare. Enable delayed expansion. Looking through some things that might modify the prompt. Oh. Oh. So to make it look like if the terminal pops open and you have these fake little lies here connecting to a verification server, establishing secure connections, that's all bogus. Ultimately, it's actually starting a new download with curl to retrieve from that cloudrecycle.com. The next stage and another one here, Figma UI design. Uh, anything else? I should turn word rap on. Sorry. Okay, so these two are the next bits and pieces that it would pull down. And there's a coyote fire dash. Sorry, I shouldn't have tried to pronounce that. Typo elite speakcloudflarechallenge.com pulled down into a text file that is then executed from PowerShell and a couple extra bogus things like resolving endpoints all on a step output using ping to kind of delay the time output. A lot of the other things here like system maintenance routines all look like kind of genuine syntax to be able to fingerprint or uncover system info, network information, critical services. You can see here Windows Defender status, antivirus storage updates, blah blah blah blah blah. Okay, there's a ton, but none of this is actually ever called. I'm going to zoom out. I'm sorry. I know that's a little overwhelming because there's a ton. After all of this, that's at least declared down below with a couple of these labels and the usual spaghetti code of batch. The very top of this file does not do any of that. The only step that they use is returning, I believe, to the end of file. Maybe I'm wrong. Please spot check me in the comments. But, uh, I'm more interested in what are these external locations that we're pulling down from. Can we get to this cloud recycled one? Yeah. Uh, okay. Is that just like a command and control marker like to indicate the progress that it's made through the chain? Let's see what the Figma UI design one does. That might considering like these variables and that that K parameter of the HTTP get. I wonder if these are just Yeah. Okay. Maybe just redundancies still just kind of denoting it got to this point in the attack chain. So, it's our ciude fire challenge.com one that would be the next payload, right? Let's hit that. Yep. [laughter] All right. Let's snag all of this, pretty please. So, this is what uh stage two. Where do we put this? We could just slap it on the desktop. That's fine. We know that this is PowerShell, correct? PS1. We could probably beautify this a little bit. I think VS Code allows us to do that because I'm just curious. I mean, I guess where does this if statement start and end? Because they have literally like a roulette action here. If get random between the bounds of 0 and two is equal to zero, then we stage a lot of these. But where is the end of this condition? Curly brace. Oh, it's down on line 12 by the else statement. So, okay. So, these are just the parts and pieces that would be probably where they get the next aspects. But look at how they represent the IP addresses here. Like this is a full URL. IRM is the PowerShell uh alias for invoke rest method. Yeah, that's IRM. I was thinking of invoke web request, which both work the same way realistically, at least for how we're seeing malware shenanigans. and they do get alias ieex. Uh trying to use a a star or a wild card to hide that. But this is still a IP address. Like I know you don't see all three of the dots to represent the octets. They're still representing what could be the I is it decimal representation or the the rest of the number data thing to be able to transform that. TAC NOP is no profile. TAC EP is execution policy bypass. We could go try and pull down what this thing might be and their variance. I don't know why they have a different IP representation there, but let's go see what these are. Check this out. Check it out. Look, uh, HTTP. Let me add the schema here. And we paste in I know what does not look like a real IP address still going to be uncovered as its actual IP address. And then the next stage, let me look at this. Let me grab the other one just as well. More PowerShell off of the internet. What does the rest of this script do, though? grabs PowerShell, starts it up, displays a little bit of a form for CDN. Oh, a Cloudflare security challenge. [laughter] They fake an entire form in PowerShell. What? [laughter] Can I run this? I want to run this. I want to invoke this code on my computer just to see what it looks like. No shot. That's so funny. I'm doing it. I'm going to put this in practice. We're not going to detonate all the actual malware parts of it, but I really want to see how funny the form looks. Give me PowerShell. Give me PowerShell right now. I don't care. Paste it in. I want to see [laughter] fake note ID, fake ray ID, staging all these different forms and windows that it should show, wiring it up just so that it looks realistic, but it's totally not. [laughter] OH MY GOD, that's awesome. You gotta you gotta tip your hat. All right, give the devil the devil is due. All right, so that is the visual distraction. Uh so that you are oblivious to the fact that these latter stages cap 3D whatever from these silly looking not IP address IP addresses uh bring this to the table. Interesting that they tried to remove a runtime environment VTC1. They're tracking a couple of the different things. Checking the PowerShell version so that they could use Oh, pulling it down. Oh. Oh, is that for PowerShell versions? Do they do a coin toss for the very first one where they have a process args and then a P args FB probably for fallback where it's the exact same instance here like looking for that the same above and below. What was the difference with this? Oh. Oh. Oh. Velcap 3D versus 3B. I didn't even notice. I was just looking at the IP addresses. So, which one do I have right now? Velcap 3E. Oh god. What is What is this one? No HTTP, please. Oh, all [snorts] right. Well, let's save the base 64 payload, I guess. I don't know if I'm going to be able to track each and every one of these little individual aspects to um the different chains and it for the sake of a YouTube video, but there's a function here to run a PS1 command just invoke and execute PowerShell with B 64 encoded argument that's provided as a parameter. Here they see us. We see them running that with get content path of app data runtime BTC1 PowerShell cab.dat pipe to idex. So that's got to be executed. Sleeps for 60 seconds cleans it up. So that must be why it's trying to remove it at the start. Download whatever it is and then write it to okay an app data rev runtime environment and then runtime environment VTC1. Okay. So that all connects together just fine. Obviously, our new B 64 payload is a zip file. What's the difference between this and the other stage? Oh, that goes to full IP address this time. Is that the same URL? It is. Yeah. I'm worried that I missed some of these, though. Yeah, I did because there's a 3C based off of a different one. Look, they're all B 64 zip files. All right, let's call that one our 3C.B64. I'm going to bring this just into Cybersh to cheat and keep it easy from B 64. And we know that that's going to be raw bytes. You can see the PK aspect here. Oh, and there's our PowerShell cab. dot kind of left in the internals. Uh, let's just download, right? Download.zip. Shoot. What one was that? Was that 3C or 3E? [laughter] That one was 3E. Now we're going to get 3C. What are we doing on this YouTube channel, everybody? All right, let's extract each of these. Now, I'm going to be honest. I kind of want to drag both of these into Sublime Text so we can keep falling down the rabbit hole here. Okay. No. So, that's PowerShell. How about you? Also PowerShell as expected, right? We've been through a lot of ex things. But each of these Oh, no. Why? Oh, some inline C# stuff though. And some types that they're trying to validate in. So, definitely going to get into some net um manage assembly stuff. These are going to be obiscated. Wait, the DAT folder is full of C code separated into different parts. Just concatenating in a couple different parts and pieces. Interesting. Okay. So they're like chunking up the full bit here and ensuring that it's then going to be able to run and detonate it all compiled with shell code for a invocation write via reflection. What is this scpaste shell code? Sure. Okay. I want to assume that's all the stop. Stop. Stop giving me all this stuff. What are you carrying in? Are you taking all of like GCC, GDB, make mingw and python? We must not be able to see everything from the sublime text output. So what was in DT or DAT each and every one of these? Oh no, they do have just their license and copying and terms and there's no binary here. Why are these here? Is it just entropy? Is it just trying to make noise? Is it just trying to add a couple extra decoration things? Packing it up. That's hysterical. So, I guess the shell code is the next stage that we would need to care about, right? So, we could try to use like scbug or speak easy. Could we do speak easy? We could go the easy option and just like throw this into dynamic analysis sandbox any run or whatever to see how it unravels. No. You know what? To be honest, this video is long enough. Honestly, the only thing I really wanted to bring to you because I thought was neat and cool was that like wild clickfix technique to be able to pull down what is already in your cache from your web browser and then have a bite specific payload pertinent to whatever web browser you're using, then being able to execute and detonate. So, I just thought that was cool. Let's go ahead and take a little bit of a cheat code. Let's go ahead and upload that stage 2.ps1, which is probably going to be enough to bring it all together. Uh, can I amp these up? Okie dokie. So, PowerShell fires. Oh, and [laughter] there's our fake stupid Cloudflare crap. Nice. Um, and of course, we can see the connections that is going to be pulling down. Oh, and a couple of like run DL32 things happen. What? What? Whoa. Goodness gracious. Here's that C sharp kicking up. Is there more that this thing kicks off? I know it's starting what looks like Edge and Chrome in their like sandbox disabled rendition. The timeout.exe exe is the one that looks super sketch that obviously invoked from places that it shouldn't have servicehost.exe and a lot of the like boilerplate Microsoft things I would expect. This was the PowerShell from the original pulld down and then timeout.exe is doing more shady shenanigans. DNS requests. Wait, was there anything out of place there? Wait, yeah, multifilehost.com at that strange looking IP address that we saw, right? Sorry, I should just be focusing on the HTTP request because we can see the exact URL that they pull down from. And they're getting multifile host connect chunk chunk chunk complete and the eventual client tasks. What is that? Are they uploading this? What the these are? Yeah, it's uploading it and staging it to the multifile host chunk of all of the things that have been present on that device. Like these are the metadata things for the any run sandbox, the computer that this is supposed to be detonating from. So it's totally uploading essentially infostal malware details to now have a place that it could go visit later. This multifile host thing is how they're streaming all of the as the cookies INFO STEALER MALWARE AND browser history. Okay. Okay. But yeah, this thing totally xfills. I just wanted to see if that domain was on virus total in case anyone has caught it before, but it's coming up kind of unseen. URL has been scanned one time 5 days ago. So, it's being used for Xville, though. We see that with that payload for sure. Hey, I don't think I can spin too much more on this one. Honestly, realistically, I think the most interesting and most valuable part is really just the beginning of the attack chain where ClickFix, what we've seen time and time again, I don't know, maybe has that little new little trick or angle or lure where they actually already have some of the payload smuggled down into your cache from the website that you visited and then the actual payload unravels it, ripping it out of your web browser cache. Thought that was clever. Thanks so much for watching everyone. I hope you enjoyed this video. Please do all those YouTube algorithm things and do certainly give some love to our sponsor down below. Thanks so much for watching.