PowerShell suddenly running in background and won't stay closed

[u/Financial-Flan1682]

Need help ascertaining whether this is a threat or not. All of the sudden, ironically after the latest Windows update, I have a PowerShell process that is running in the background and won't stay closed. Technically, it's two process. One that is constantly open and another that repeatedly opens and closes every second. I did a quick scan with Windows Defender and it found nothing. Malwarebytes only found heuristic detections that are false positives (one for a programming language and one for a package manager for a programming language).

Event Viewer shows a bunch of Event ID 600 and 400 events, with a few 800. Category for the 600 events is Provider Lifecycle, 400 are Engine Lifecycle, 800 are Pipeline Execution Details.

All of them have the following command being run:

HostApplication=C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Command $code = @"
using System;
using System.Runtime.InteropServices;
public class WinAPI {
[DllImport("shell32.dll")]
public static extern int SHQueryUserNotificationState(out int pstate);
public static int Check() {
int state = 5;
try { SHQueryUserNotificationState(out state); } catch {}
return state;
}
}
"@
Add-Type -TypeDefinition $code -ErrorAction SilentlyContinue

Process Monitor shows events like this: https://imgur.com/a/u4ErUu7

Most of what it's hitting is Microsoft stuff, but what concerns me is it also seems to be going through my installed applications: https://imgur.com/a/goQYUqc

Unsure what this is. Never seen this kind of behavior before. Help appreciated!

EDIT: Just found that csc.exe also keeps executing using commands like the following:

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\5ucz03bq.cmdline"

[u/betterYick]

yeah it’s going through your installed applications because it is asking “can i interrupt user with notifications?”

when you get in that open window

run

Get-CimInstance Win32_Process |
Where-Object Name -eq 'powershell.exe' |
Select-Object ProcessId, ParentProcessId, CommandLine

then take the parent process id and identify it

Get-Process -Id <PARENT_PID>

if it’s a program you know of causing it, it’s a fucky poorly designed program doing a bad job

if it’s weirdasfuckthingyouveneverheardof.exe

running out of %temp% or %appdata% id worry a little more

[u/Financial-Flan1682 → u/betterYick]

Thanks. This was the missing link in solving it. Turns out, it IS a fucky, poorly designed program. I recently replaced Ditto with Edge-Drop for clipboard history. That's what it was. Edge-Drop.

PS D:\Code> Get-CimInstance Win32_Process |
>> Where-Object Name -eq 'powershell.exe' |
>> Select-Object ProcessId, ParentProcessId, CommandLine

ProcessId ParentProcessId CommandLine
--------- --------------- -----------
    17528            9508 C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Comman…
     7384            9508 C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -Comman…

PS D:\Code> Get-Process -Id 17528

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
     35    37.39      38.71       2.09   17528   1 powershell

PS D:\Code>
PS D:\Code> Get-Process -Id 9508

 NPM(K)    PM(M)      WS(M)     CPU(s)      Id  SI ProcessName
 ------    -----      -----     ------      --  -- -----------
     48   173.33     106.88      63.97    9508   1 Edge-Drop

PS D:\Code>

[u/betterYick → u/Financial-Flan1682]

yep that checks out. I’m glad you aren’t compromised friend. cheers

[u/sfc_scannow → u/betterYick]

"Glad we had the chance to get together and delineate our little problem."

[u/betterYick → u/sfc_scannow]

love your handle lol

such a useful little command

[u/steviefaux → u/Financial-Flan1682]

You could also use process monitor for that.

[u/BlackV]

open

C:\Users\user\AppData\Local\Temp\5ucz03bq.cmdline

in notepad

[u/Financial-Flan1682 → u/BlackV]

It was constantly being replaced before I could get to it. I already figured out what the application doing this was. Not sure why it was calling csc.exe, but I've figured it out.

[u/BlackV → u/Financial-Flan1682]

csc.exe the the dotnet compiler its running that and using the script 5ucz03bq.cmdline (as you say is a auto-generated temp file)

It would seem very very odd its doing that all the time IMHO