ClickFix Payload Searches Firefox Profiles Before Hidden Batch Execution

Summary

John Hammond analyzes a ClickFix payload that searches files in the Windows Firefox profiles directory, checks a numeric condition, copies a matching file to a temporary location named t.bat, and runs it without displaying it.

Key points

• Hammond describes the payload as a clever variant of ClickFix and says he has not often seen this approach.
• The command uses cmd.exe /C to run a command.
• It loops through files in the Firefox profiles directory under the Windows user's local application data.
• The payload checks each file against a condition that includes the value 17,635.
• When the condition is met, it copies the corresponding file to a temporary location named t.bat and runs it without displaying it.