Windows Analysis Report
https://focuslight.com/

## Malware Behavior Analysis

### Overall Behavior
This sample represents a ClickFix scam campaign that uses social engineering to trick users into executing malicious commands through clipboard manipulation. The attack leverages a fake CAPTCHA verification page to deceive users into manually executing obfuscated PowerShell commands that download and execute additional malware.

### Initial Access
The malware initiates through a web-based attack vector. Chrome browser processes navigate to focuslight.com, which presents a fraudulent "Verify you are human" CAPTCHA page. The page instructs users to press Win+R, then Ctrl+V, and Enter to complete verification, effectively tricking them into executing clipboard content.

### Evasion Techniques
- **Command Obfuscation**: The malware employs character-level obfuscation in the command line, using caret (^) characters to break up the curl command (`c^u^rl.e^x^e`) to evade detection
- **Social Engineering**: Uses a fake Cloudflare security check interface to appear legitimate and encourage user interaction
- **Manual Execution**: Relies on user interaction rather than automated exploitation, potentially bypassing automated security controls

### Payload Execution and Staging
The clipboard contains an obfuscated command that:
1. Uses curl to download a payload from `https://quickfreightuae.com/head.php?` via POST request
2. Saves the downloaded content as `C:\Users\Public\sxa.bat`
3. Executes the downloaded batch file minimized using `start /min`

A cmd.exe process (PID 6624) was observed with the obfuscated command line, indicating successful execution of the clipboard payload.

### Network Activity
- **C2 Communication**: The malware attempts to contact `quickfreightuae.com` to retrieve the second-stage payload
- **JavaScript Loading**: Obfuscated JavaScript is loaded from `forging.top/xlg/track.js`, likely for tracking or additional payload delivery

### Process Relationships
- Chrome browser processes (PIDs 1232, 2616, 6448) handle the initial web-based attack vector
- cmd.exe (PID 6624) executes the obfuscated clipboard command
- conhost.exe (PID 6636) is spawned as a child of the cmd.exe process to handle console operations

### MITRE ATT&CK TTPs
- **T1204.001** - User Execution: Malicious Link (social engineering via fake CAPTCHA)
- **T1027** - Obfuscated Files or Information (command line and JavaScript obfuscation)
- **T1566.002** - Phishing: Spearphishing Link (drive-by download via malicious website)
- **T1105** - Ingress Tool Transfer (downloading payload via curl)
- **T1059.003** - Command and Scripting Interpreter: Windows Command Shell (batch file execution)