Overview
overview
8Static
static
3Velocity.zip
windows10-2004-x64
1Velocity.zip
windows11-ltsc_2024-x64
8Velocity/B...64.dll
windows10-2004-x64
1Velocity/B...64.dll
windows11-ltsc_2024-x64
1Velocity/S...lua.js
windows10-2004-x64
3Velocity/S...lua.js
windows11-ltsc_2024-x64
3Velocity/S...de.lua
windows10-2004-x64
3Velocity/S...de.lua
windows11-ltsc_2024-x64
8Velocity/S...FE.bat
windows10-2004-x64
1Velocity/S...FE.bat
windows11-ltsc_2024-x64
1Velocity/S...ius.js
windows10-2004-x64
3Velocity/S...ius.js
windows11-ltsc_2024-x64
8Velocity/Velocity.exe
windows10-2004-x64
4Velocity/Velocity.exe
windows11-ltsc_2024-x64
4Velocity/V...PI.dll
windows10-2004-x64
1Velocity/V...PI.dll
windows11-ltsc_2024-x64
1Velocity/W...er.dll
windows10-2004-x64
3Velocity/r...er.dll
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
Velocity.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Velocity.zip
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral3
Sample
Velocity/Bin/VMProtectSDK64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
Velocity/Bin/VMProtectSDK64.dll
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral5
Sample
Velocity/Scripts/Favourites/Dark Dex,lua.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
Velocity/Scripts/Favourites/Dark Dex,lua.js
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral7
Sample
Velocity/Scripts/Favourites/Hydroxide.lua
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
Velocity/Scripts/Favourites/Hydroxide.lua
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral9
Sample
Velocity/Scripts/Fun Scripts/Infinite Yield FE.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
Velocity/Scripts/Fun Scripts/Infinite Yield FE.bat
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral11
Sample
Velocity/Scripts/Fun Scripts/Sirius.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
Velocity/Scripts/Fun Scripts/Sirius.js
Resource
win11ltsc2024-20260617-en
Behavioral task
behavioral13
Sample
Velocity/Velocity.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
Velocity/Velocity.exe
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral15
Sample
Velocity/VelocityAPI.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
Velocity/VelocityAPI.dll
Resource
win11ltsc2024-20260618-en
Behavioral task
behavioral17
Sample
Velocity/WebView2Loader.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
Velocity/runtimes/win-x86/native/WebView2Loader.dll
Resource
win10v2004-20260513-en
General
- Target Velocity/Scripts/Favourites/Hydroxide.lua
- Size 273B
- Sample260620-3bb5gsa15x
- SHA256 e9a0001ea23ed9f391c327a94d65709e0e13662d540686335d5576f172100f3f
- MD5 58379cbb55d775f89a08852a087d4fc9
- SHA1 feab23989e2296d8f732bebe8431541ffa7f30fa
- SHA512 a4beb0caed2a1c7a22df779700f352b751df3b504f639a2412bed96eafb6f5e0a84c71ad447f34ae0042ab28738011b59576e872aa1e15650a16d099b9ec8f9b
- TLSH T14CD02B7FB8A7A1180337CCC9849162A5AE103209778891F3A84921B09A311DD00F0399
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2616 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Velocity\Scripts\Favourites\Hydroxide.lua1⤵
- Modifies registry class
PID:6048
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2616