Hiding In Plain Sight

This report analyzes a stealthy malware foothold that masquerades as a legitimate scheduled task (BfeOnServiceStartTypenChange), using renamed system binaries (mshta.exe and powershell.exe) to decode and execute an obfuscated PowerShell payload stored in a file that resembles an error log (c:\windows\a.chk). The author breaks down the command, explains how decimal values are converted to ASCII to reconstruct the payload, and highlights the technique of hiding in plain sight by copying legitimate task names and descriptions to avoid detection.