Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/05/2026, 04:27
General
- Target Volt Installer/win-64/Resources/Modules/PSRule.Rules.Azure/rules/Azure.EventHub.Rule.ps1
- Size 14KB
- Sample260516-e27r3say2z
- SHA256 c0ae2cd4552f9112a796e73ad53d9316d886b4ed5de3c0a0f49294f977f91f99
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Volt Installer\win-64\Resources\Modules\PSRule.Rules.Azure\rules\Azure.EventHub.Rule.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5ag2unje.hov.ps1
memory/1196-19-0x0000017777B20000-0x0000017777B2A000-memory.dmp
memory/1196-22-0x0000017777FE0000-0x0000017777FFA000-memory.dmp
memory/1196-0-0x000001775C6B0000-0x000001775C6C0000-memory.dmp
memory/1196-9-0x000001775C6B0000-0x000001775C6C0000-memory.dmp
memory/1196-10-0x00007FF47EAB0000-0x00007FF47EAC0000-memory.dmp
memory/1196-17-0x0000017777A40000-0x0000017777A5C000-memory.dmp
memory/1196-2-0x00000177779B0000-0x00000177779D2000-memory.dmp
memory/1196-20-0x0000017777EC0000-0x0000017777EDC000-memory.dmp
memory/1196-18-0x0000017777A60000-0x0000017777B13000-memory.dmp
memory/1196-21-0x0000017777B30000-0x0000017777B3A000-memory.dmp
memory/1196-1-0x000001775C6B0000-0x000001775C6C0000-memory.dmp
memory/1196-23-0x0000017777B40000-0x0000017777B48000-memory.dmp
memory/1196-24-0x0000017777B50000-0x0000017777B56000-memory.dmp
memory/1196-25-0x0000017778000000-0x000001777800A000-memory.dmp
memory/1196-26-0x000001775C6B0000-0x000001775C6C0000-memory.dmp