This Sherlock provides players with an opportunity to analyze a compromised Windows workstation following a variant of ClickFix social engineering attack, where the victim is tricked into executing a malicious command via File Explorer, leading to reverse shell execution and persistence.
A user on a Windows workstation opened Chrome and landed on a phishing page that told them to paste a command into the File Explorer address bar. The pasted command made PowerShell pull a reverse-shell script from a host on the local network. A Notepad window with a message from the attacker followed, and a payload masquerading as a Windows update binary was dropped into the Windows temp folder. That payload created a scatter of junk-named directories, staged a batch file by copying a data file over itself, and used a renamed AutoIt interpreter to drop a script. The malware then looked for common antivirus processes and finished by writing a Startup-folder shortcut that relaunches the script at every logon. Sysmon in the event logs carries nearly the whole chain; the prefetch, browser history and $MFT fill the gaps.
winevt logs, Security and Sysmon Operational → parse with EvtxECmd.pf files → PECmdAmcache.hve → AmcacheParsersqlite3 or DB Browser for SQLiteTimestamp note: Q1 and Q2 want
YYYY-MM-DD hh:mm:ss. Sysmon, Security and prefetch all agreed on the same clock, so no conversion was needed.
Parse the event logs to CSV and filter Security 4624 for the interactive logon of the user account (LogonType 2, console logon). The latest one for that account is the answer; service and system logons around it are noise.
EvtxECmd -d evidence/winevt/Logs --csv work/evtx --csvf evtx.csvgrep ',4624,' work/evtx/evtx.csv | grep -i 'user'The user’s regular browser is Chrome, so the CHROME.EXE prefetch file holds the last run time. Sysmon process creation for Chrome gives the same second.
PECmd -d evidence/Windows/prefetch --csv work/pfFrom Q2 Chrome started at 07:12:17, so look for the visit seven seconds later. Copy the Chrome History database out of the profile and read the urls table by last visit time. The only unfamiliar site at 07:12:24 is a randomly named Netlify subdomain, which is the lure page.
sqlite3 work/sql/History "select url, datetime(last_visit_time/1000000-11644473600,'unixepoch') from urls order by last_visit_time desc limit 10"Sysmon Event ID 1 (process creation) shortly after the Q3 visit shows powershell.exe at 07:12:51 running an IEX of a DownloadString call. The download target is an internal address on port 8000 serving a .ps1, which makes the attacker’s staging host a machine on the same network.
grep -i 'DownloadString' work/evtx/evtx.csvThis one was reasoned, not read from an artifact. The scenario calls the attack a variant of ClickFix, and the Q4 evidence shows the delivery: a command pasted into the File Explorer address bar rather than the Run dialog or a terminal. That File Explorer variant is called FileFix.
Gotcha: The generic name, ClickFix, is the obvious answer and is not what was accepted. The scenario’s word “variant” and the File Explorer paste point at the specific name.
Nothing in the event logs carried the message text, so search the evidence for the file Notepad opened. A README.txt turns up in the $MFT. It is small enough to be resident, meaning its content is stored inside the MFT record itself and no tool surfaces it. Locate the record, then read the resident data attribute with a short Python script.
grep -rla README.txt evidence/Tip: Resident
$MFTdata is invisible to normal MFT parsers’ CSV output, so carve the record’s data attribute directly.
Sysmon Event ID 1 and Event ID 11 (file create) both show an executable named like a Windows update dropped in the Windows temp folder. A Windows update does not live there, and the Amcache entry agrees it was newly seen.
AmcacheParser -f evidence/Windows/AppCompat/Programs/Amcache.hve --csv work/amcgrep -i 'WindowsUpdate' work/amc/*.csvThe Sysmon Event ID 1 record for the Q7 binary includes the PE Product field from its version resource. It names the product something unrelated to Windows Update, which confirms the filename was a disguise.
grep -i 'WindowsUpdate.exe' work/evtx/evtx.csvFilter Sysmon Event ID 11 for the Q7 binary as the creating process. It creates a run of oddly named directories (MatthewSouthern, CombinedStarts, PastDesigns and others) that all sit directly under the same parent, the Windows folder itself.
grep -i 'WindowsUpdate.exe' work/evtx/evtx.csv | grep -i 'MatthewSouthern'Follow the children of the Q7 process in Sysmon Event ID 1. A cmd.exe /c launches a copy of a file with no extension onto the same name with .bat added, then runs the result. The format mask in the task matches this shape.
grep -i 'Cricket' work/evtx/evtx.csvFrom Q10 the batch file is Cricket.bat. The Sysmon Event ID 11 record for its creation gives the full path, in the user’s Temp folder.
grep -i 'Cricket.bat' work/evtx/evtx.csvThe batch file from Q11 builds a working directory in Temp with a numeric name and writes a .pif file there. .pif is the legacy format. Sysmon’s OriginalFileName for that process is AutoIt3.exe, so the .pif is a renamed AutoIt interpreter. The Amcache entries for it back this up.
grep -iE 'Intranet|\.pif' work/amc/*.csvThe Sysmon Event ID 1 record for Intranet.pif carries the original filename and a FileVersion of 3, 3, 14, 3. Rewrite that in the format the task wants.
grep -i 'Intranet.pif' work/evtx/evtx.csvFilter Sysmon Event ID 11 for files created by Intranet.pif as the process image. It writes one script, a .js file named after the malware’s product from Q8.
grep -i 'Intranet.pif' work/evtx/evtx.csv | grep -i 'Virtuoso'Sysmon Event ID 1 shows the AV and EDR checks as a pair of commands launched from the staged script’s process tree. The second is a findstr -I over a quoted list of vendor process names (Avast, AVG, Bitdefender, Norton, Sophos).
grep -i 'findstr' work/evtx/evtx.csvGotcha: The Sysmon
CommandLinefield shows a double space afterfindstr. The accepted answer has a single space, so normalise it.
The last notable Sysmon Event ID 1 is a cmd /k at 07:32:49 that writes a two-line .url file into the user’s Startup folder. The URL= value points at the Q14 script, so it runs at every logon.
grep -i 'Startup' work/evtx/evtx.csv | grep -i 'InternetShortcut'| Phase | Action |
|---|---|
| Initial Access | User logs on and opens Chrome, then visits a phishing page on Netlify |
| Execution | Pasted command in File Explorer runs PowerShell, which fetches a reverse shell from an internal host |
| Impact | Notepad opens with a message and contact email from the attacker |
| Execution | Disguised update binary dropped in the Windows temp folder, product name is Virtuoso |
| Execution | Malware creates junk-named directories under the Windows folder |
| Execution | Batch file staged with a copy-over-itself trick, then a renamed AutoIt interpreter runs and drops a script |
| Discovery | findstr checks for common AV and EDR processes |
| Persistence | Startup-folder .url shortcut relaunches the dropped script at logon |
| Timestamp | Event |
|---|---|
| 2025-08-11 06:46:52 | Last successful interactive logon of user |
| 2025-08-11 07:12:17 | Chrome last opened |
| 2025-08-11 07:12:24 | Phishing page visited in Chrome |
| 2025-08-11 07:12:51 | PowerShell downloads and runs rev.ps1 |
| 2025-08-11 07:32:49 | Startup-folder persistence command runs |
| Type | Value |
|---|---|
| URL (phishing) | hxxps[://]cool-bunny-55393d[.]netlify[.]app/ |
| URL (payload) | hxxp[://]192[.]168[.]26[.]128:8000/rev.ps1 |
0xSh3rl0cK@protonmail[.]com | |
| File | C:\Windows\Temp\WindowsUpdate.exe (product name Virtuoso) |
| File | C:\Users\user\AppData\Local\Temp\Cricket.bat |
| File | C:\Users\user\AppData\Local\Temp\316094\Intranet.pif (AutoIt 3.3.14.3) |
| File | Virtuoso.js in C:\Users\user\AppData\Local\Immersive Creations Co\ |
| File | Virtuoso.url in the user’s Startup folder |
| Technique | ID | Description |
|---|---|---|
| Phishing: Spearphishing Link | T1566.002 | Lure page reached through a phishing link |
| User Execution: Malicious Copy and Paste | T1204.004 | Victim pasted the attacker’s command into the File Explorer address bar |
| Command and Scripting Interpreter: PowerShell | T1059.001 | IEX of a remote rev.ps1 |
| Ingress Tool Transfer | T1105 | Reverse shell script and the disguised binary pulled onto the host |
| Command and Scripting Interpreter: Windows Command Shell | T1059.003 | cmd /c batch staging and the persistence cmd /k |
| Software Discovery: Security Software Discovery | T1518.001 | findstr over AV and EDR process names |
| Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | T1547.001 | .url shortcut in the Startup folder |
Treat a PowerShell child of explorer.exe as hostile. A user typing into the File Explorer address bar should never lead to powershell.exe fetching a script with IEX and DownloadString. Sysmon process creation caught this at 07:12:51, so alerting on that parent-child pair would have fired within seconds of the paste.
Sysmon was the whole investigation, so keep it on and keep it long. Process creation and file-create events gave the payload, the staging command, the AV check and the persistence command with full command lines. Without them, the same questions would have needed prefetch, Amcache and $MFT carving.
Flag version-resource mismatches. A binary named WindowsUpdate.exe in C:\Windows\Temp with a Product of something else, and a .pif whose OriginalFileName is AutoIt3.exe, are both cheap detections. Compare the on-disk name against the PE metadata and alert when they disagree.
Watch the Startup folder for .url files. The persistence command writes a shortcut through cmd /k echo, which is easy to match on InternetShortcut plus a Startup path. A file-create rule for that folder gives the same coverage.
User awareness has to cover the File Explorer variant. Training that only warns against the Run dialog misses a paste into the address bar. The lure works because the pasted text looks like a path or a search.
The attacker got a reverse shell, a malware drop and logon persistence from one pasted command, without exploiting a single vulnerability. The whole chain was visible in Sysmon within about twenty minutes, so the lesson is detection on the process tree rather than on any one file.