Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/05/2026, 04:27
General
- Target Volt Installer/win-64/Resources/Modules/PSRule.Rules.Azure/rules/Azure.APIM.Rule.ps1
- Size 34KB
- Sample260516-e27r3say2z
- SHA256 3b0319859c6d11558e3167f69f7b75e514462e279a50021fdcffa1dda19c1981
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Volt Installer\win-64\Resources\Modules\PSRule.Rules.Azure\rules\Azure.APIM.Rule.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_s0nszsnu.r2p.ps1
memory/1096-19-0x000001C985AF0000-0x000001C9865B2000-memory.dmp
memory/1096-21-0x000001C99EE10000-0x000001C99EE2C000-memory.dmp
memory/1096-8-0x000001C985AF0000-0x000001C9865B2000-memory.dmp
memory/1096-9-0x000001C985AF0000-0x000001C9865B2000-memory.dmp
memory/1096-16-0x000001C99ED00000-0x000001C99ED1C000-memory.dmp
memory/1096-18-0x000001C985AF0000-0x000001C9865B2000-memory.dmp
memory/1096-17-0x000001C99ED20000-0x000001C99EDD3000-memory.dmp
memory/1096-0-0x000001C9862BA000-0x000001C9862BB000-memory.dmp
memory/1096-1-0x000001C99EC40000-0x000001C99EC62000-memory.dmp
memory/1096-22-0x000001C99EDF0000-0x000001C99EDFA000-memory.dmp
memory/1096-20-0x000001C99EDE0000-0x000001C99EDEA000-memory.dmp
memory/1096-23-0x000001C99EE50000-0x000001C99EE6A000-memory.dmp
memory/1096-26-0x000001C99EE40000-0x000001C99EE4A000-memory.dmp
memory/1096-25-0x000001C99EE30000-0x000001C99EE36000-memory.dmp
memory/1096-24-0x000001C99EE00000-0x000001C99EE08000-memory.dmp
memory/1096-27-0x000001C985AF0000-0x000001C9865B2000-memory.dmp
memory/1096-30-0x000001C985AF0000-0x000001C9865B2000-memory.dmp