hxxps://jemi[.]so/mitnemidkundeservice

Analysis

max time kernel
26s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jemi.so/mitnemidkundeservice
Sample240402-vamwlaff4x

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	firefox.exe
Token: SeDebugPrivilege	3492	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3492	firefox.exe
3492	firefox.exe
3492	firefox.exe
3492	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3492	firefox.exe
3492	firefox.exe
3492	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 2336 wrote to memory of 3492	2336	firefox.exe	85
PID 3492 wrote to memory of 2104	3492	firefox.exe	86
PID 3492 wrote to memory of 2104	3492	firefox.exe	86
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 2648	3492	firefox.exe	87
PID 3492 wrote to memory of 4896	3492	firefox.exe	88
PID 3492 wrote to memory of 4896	3492	firefox.exe	88
PID 3492 wrote to memory of 4896	3492	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://jemi.so/mitnemidkundeservice"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://jemi.so/mitnemidkundeservice
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.0.1373917927\85263925" -parentBuildID 20221007134813 -prefsHandle 1888 -prefMapHandle 1896 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ba5276c-d934-4d26-ad96-6d383efb8f64} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 1976 1f9f3edce58 gpu
    3⤵
    PID:2104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.1.969249361\1141934033" -parentBuildID 20221007134813 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbd275f6-9f0d-49d5-b357-8dd515b4ffb4} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 2400 1f9e7672b58 socket
    3⤵
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.2.873144164\800752353" -childID 1 -isForBrowser -prefsHandle 3176 -prefMapHandle 3172 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abf66113-9a80-46e4-b377-2ae7c9da08dc} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 3188 1f9e7667b58 tab
    3⤵
    PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.3.281915140\1579347984" -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 3620 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8152a596-6b03-46ea-90bd-dcc5c8326eb4} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 3636 1f9f91b0158 tab
    3⤵
    PID:3992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.4.1712105853\1560991887" -childID 3 -isForBrowser -prefsHandle 4980 -prefMapHandle 5008 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ff8f2c7-adb8-48c9-ab68-70f6a4e61014} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 4984 1f9fa48a558 tab
    3⤵
    PID:1128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.5.1254712122\895360840" -childID 4 -isForBrowser -prefsHandle 5136 -prefMapHandle 5140 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbb05507-920e-456b-bca6-31dd371ff0f0} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 5124 1f9faa2a558 tab
    3⤵
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.6.1526845138\1615241263" -childID 5 -isForBrowser -prefsHandle 5324 -prefMapHandle 5328 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df92c1dd-c221-47f9-962d-987ddff49812} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 5412 1f9faa2ab58 tab
    3⤵
    PID:1088
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3492.7.374475536\1659430004" -childID 6 -isForBrowser -prefsHandle 3580 -prefMapHandle 3576 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1416 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d0bc666-ab2d-4656-b98b-9ab64602d5fe} 3492 "\\.\pipe\gecko-crash-server-pipe.3492" 1436 1f9f7d40958 tab
    3⤵
    PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 ae287f98071b5973748e1dbc54dc153099cf4c16c09f825c4113c2c535b23b1e
MD5 c41e827bbe8b2cc73af83162bd80a27a
SHA1 e4bbbf908f97cbb9123a8d8a72066043df2047df
SHA512 4f90b903c5d8dfc97438d4047a3c65aaee7ca6c7fbefcf75fffddd9270ba1d763c8d76178ff02040c3233c02d56a558fd698aec2090986e62cc568b9f09da894
MD5 SHA1 SHA512

Submit Download

02eaf919-d657-4353-9629-cf9e41192872

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\datareporting\glean\pending_pings\02eaf919-d657-4353-9629-cf9e41192872
Size 746B
SHA256 1f29e13192a3de662a0486c98c652032cccf27c4af95f5421aaa602d33e3f193
MD5 5ef5aa94f1d72c353cc70d16c79e6ecf
SHA1 9b7cc2cbd3c7920017730dde256d905f4bc30b31
SHA512 823fec0e34d9eaec0b6dd2835240b4a0a653af35c9e37f5901290ecac25b5aa3d89f4e3421b950ab30a618d259ddc708a663712b686db09e35de64124c105c3b
MD5 SHA1 SHA512

Submit Download

eb584b04-54d5-4e7e-b8fa-492f50bfecb4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\datareporting\glean\pending_pings\eb584b04-54d5-4e7e-b8fa-492f50bfecb4
Size 12KB
SHA256 086f5a11b2344fc29566ae682714cc25c9f9c9b19f4ce0850032bf4cfe1d7522
MD5 aff09d39d43fa6efc0c17f36c607b0d1
SHA1 3198ee49be8c56fdf42426b0fdd1dc801f04f5ab
SHA512 3ac457467f36257339bb588bb6e798e558aad78a77efa7776237badac0a8c6938db2c0d7ed154c756d753743665c6d06b7452510d17c2333c9546e202efc82c0
SSDEEP 192:79avC7G+I7E5EcALi/UR7oUQ8B+tFY4E73OK2KEj3cjpac1Fo1UIhiFXsrjIMFcl:79aSG+UcAKpC
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\prefs-1.js
Size 6KB
SHA256 101ce8300a62418a5b3a20b7acc8355d951a4419118b3353953b51f54815b560
MD5 d2dbd858b12b2ff15ccf032058917e8f
SHA1 7febbe267343d6578c7613a943b81316a50afe37
SHA512 a0eaa5b642e35bbcf7ca24fabedffc3e29c7b8951a1a0c119ee0f3a3759a8fd7776d54e83c81f1e5c857b164427679663e25429ff8981a84900305e991957457
SSDEEP 96:xHG5nUTeqGqVdVYQeOTzSnPXAnpj3HRQYaSHkLBw8HL49:o5nIRVdVYQeVPXIraSHkLBw8Hw
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\prefs.js
Size 6KB
SHA256 c0aa1e61722176f3a452a58c77f8449b58259d4b4f6a633a3ba3a23f79011063
MD5 6f9008cfe239c509a250f878121a23d4
SHA1 468a56bb8117a683cdb4c57a5122abaaa1c5102f
SHA512 22bec7fe10814e6c64b1e68e550078116ac107eedbc5ff63b267163d133ed8e651ed2035bd2b700583a414a52c69d4466b79cde1193266794be6dc47d9d2eb42
SSDEEP 96:xHG5nUTeqGqVdVWreOTzSnhPXAnpjnHRQYaSHk0Bw8VL49:o5nIRVdVWre/PXAraSHk0Bw8Vw
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\sessionstore-backups\recovery.jsonlz4
Size 2KB
SHA256 3a7ebeef646bfca84e0b659e53a88c11d64cbf1b05868ac0137cdc29ac790782
MD5 99362a4c24ab0ef3b9f77cb848940131
SHA1 0a6a103d23a83fc3620c896e548fed5267f4b786
SHA512 ac1e30e96fe562627f65dc4757612db9c18da0c49fc59d26f9e3675bc7976455998bd3f2aba9c4dc1f554a65f8069e9d6a16512bed727da89853bd8068702166
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads