Windows Analysis Report
https://thefatshallot.com/

# Phishing Attack Analysis

## Threat Overview
A sophisticated web-based social engineering attack attempting to manipulate users into executing malicious commands by leveraging deceptive UI techniques and multi-stage redirection.

## Key Findings

### Initial Lure
- Original URL: https://thefatshallot.com/
- Unexpected redirection to a random domain: xpoalswwkjddslsjy.com

### Deception Techniques
- Fake Cloudflare verification page used as an initial misdirection
- Full-screen blue page mimicking Windows Update interface
- Goal: Trick users into executing potentially harmful system commands

### Technical Manipulation
- Instructions direct user to:
  - Open Run dialog (Win+R)
  - Paste specific commands (Ctrl+V)
  - Press Enter to execute
- Deliberately mismatched browser and system UI to confuse user

### Attack Indicators
- Random, suspicious domain
- Unrelated initial website
- Aggressive social engineering tactics
- Attempt to bypass user's security awareness

## Conclusion
A multi-stage phishing attack designed to manipulate users into executing potentially malicious commands by exploiting familiar system interfaces and creating a sense of urgency through fake system update screens.

## Malware Behavior Analysis

### Initial Access
The malware initiates through a web-based attack chain beginning with Chrome navigating to `https://thefatshallot.com/`. This website serves as a malicious landing page that implements a CAPTCHA scam using ClickFix techniques to deceive users into executing malicious commands.

### Evasion Techniques
The malware employs several evasion mechanisms:
- **Anti-analysis techniques**: Implements timestamp-based debugging detection to evade dynamic analysis environments
- **Command obfuscation**: Uses deliberate case anomalies in PowerShell execution (`POWERsHeLl`) and string fragmentation in URLs to bypass detection systems
- **Social engineering**: Presents a fake Windows Update interface and Cloudflare verification page to appear legitimate while instructing users to execute clipboard content via Win+R and Ctrl+V

### Payload Execution
The attack chain proceeds through multiple stages:
1. **mshta.exe** (PID 6604) executes to retrieve a remote payload from `http://141.0x62.80.175/rtdx.dat`
2. **PowerShell** (PID 1884) is spawned by mshta.exe with an obfuscated command attempting to download and execute content from `xoiiasdpsdoasdpojas.com` using `Invoke-Expression` and `Invoke-WebRequest`
3. **conhost.exe** (PID 4436) is launched to support the PowerShell console session

### Network Activity
The malware establishes connections to multiple domains:
- Initial contact with `thefatshallot.com` for the malicious landing page
- Secondary payload retrieval from `141.0x62.80.175/rtdx.dat`
- Attempted third-stage download from `xoiiasdpsdoasdpojas.com`

### Data Manipulation
The malicious webpage adds suspicious content to the system clipboard, likely containing commands designed to be executed when users follow the fake verification instructions.

### MITRE ATT&CK TTPs
- **T1566.002** - Phishing: Spearphishing Link
- **T1218.005** - System Binary Proxy Execution: Mshta
- **T1059.001** - Command and Scripting Interpreter: PowerShell
- **T1140** - Deobfuscate/Decode Files or Information
- **T1027** - Obfuscated Files or Information
- **T1204.001** - User Execution: Malicious Link

The attack represents a multi-stage web-based compromise leveraging social engineering, legitimate system binaries, and obfuscated PowerShell commands to establish initial access and attempt further payload deployment.