Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/05/2026, 04:27
General
- Target Volt Installer/win-64/Resources/Modules/PSRule.Rules.Azure/rules/Azure.AppGw.Rule.ps1
- Size 17KB
- Sample260516-e27r3say2z
- SHA256 bba4d9ca593322acb684d23378df9e9c8943384def39e664ba0c780ddbdb898f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\Volt Installer\win-64\Resources\Modules\PSRule.Rules.Azure\rules\Azure.AppGw.Rule.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_20pfwofr.c10.ps1
memory/3460-19-0x000001B5E4740000-0x000001B5E474A000-memory.dmp
memory/3460-22-0x000001B5E4CC0000-0x000001B5E4CDA000-memory.dmp
memory/3460-0-0x000001B5C89B0000-0x000001B5C89C0000-memory.dmp
memory/3460-9-0x000001B5C89B0000-0x000001B5C89C0000-memory.dmp
memory/3460-10-0x00007FF457010000-0x00007FF457020000-memory.dmp
memory/3460-17-0x000001B5E4720000-0x000001B5E473C000-memory.dmp
memory/3460-2-0x000001B5C8B20000-0x000001B5C8B42000-memory.dmp
memory/3460-20-0x000001B5E4CA0000-0x000001B5E4CBC000-memory.dmp
memory/3460-18-0x000001B5E4970000-0x000001B5E4A23000-memory.dmp
memory/3460-21-0x000001B5E4750000-0x000001B5E475A000-memory.dmp
memory/3460-1-0x000001B5C89B0000-0x000001B5C89C0000-memory.dmp
memory/3460-24-0x000001B5E4C90000-0x000001B5E4C96000-memory.dmp
memory/3460-23-0x000001B5E4C80000-0x000001B5E4C88000-memory.dmp
memory/3460-25-0x000001B5E4CE0000-0x000001B5E4CEA000-memory.dmp
memory/3460-26-0x000001B5C89B0000-0x000001B5C89C0000-memory.dmp