Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/05/2026, 04:27
General
- Target Volt Installer/win-64/Resources/Modules/PSRule.Rules.Azure/rules/Azure.Cosmos.Rule.ps1
- Size 15KB
- Sample260516-e27r3say2z
- SHA256 b766f61a82d85aa97ce5602f987c6fac4ad879a818afd5bbdd925f67d1b1d705
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Volt Installer\win-64\Resources\Modules\PSRule.Rules.Azure\rules\Azure.Cosmos.Rule.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_anyd2hpd.bhw.ps1
memory/2512-19-0x000001AF22240000-0x000001AF2224A000-memory.dmp
memory/2512-22-0x000001AF3DCA0000-0x000001AF3DCBA000-memory.dmp
memory/2512-8-0x000001AF221A0000-0x000001AF221C2000-memory.dmp
memory/2512-9-0x000001AF206C0000-0x000001AF206D0000-memory.dmp
memory/2512-11-0x00007FF416540000-0x00007FF416550000-memory.dmp
memory/2512-17-0x000001AF3DC20000-0x000001AF3DC3C000-memory.dmp
memory/2512-1-0x000001AF206C0000-0x000001AF206D0000-memory.dmp
memory/2512-20-0x000001AF3DC60000-0x000001AF3DC7C000-memory.dmp
memory/2512-18-0x000001AF3DEF0000-0x000001AF3DFA3000-memory.dmp
memory/2512-21-0x000001AF3DC40000-0x000001AF3DC4A000-memory.dmp
memory/2512-0-0x000001AF206C0000-0x000001AF206D0000-memory.dmp
memory/2512-23-0x000001AF3DC50000-0x000001AF3DC58000-memory.dmp
memory/2512-24-0x000001AF3DC80000-0x000001AF3DC86000-memory.dmp
memory/2512-25-0x000001AF3DC90000-0x000001AF3DC9A000-memory.dmp
memory/2512-26-0x000001AF206C0000-0x000001AF206D0000-memory.dmp