34e342d2799a3c81397b7198c57696017c95c68fa9d1bde9f52124d5c01beea2

Analysis

user interaction
yes
max time kernel
30s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 60.4MB
Sample260620-bgh2facx2j
SHA256 34e342d2799a3c81397b7198c57696017c95c68fa9d1bde9f52124d5c01beea2
MD5 18783821c819bcff52ad53ca97a59c11
SHA1 4211c6dd2b372aa88713670770ab430b9b11a993
SHA512 53e4988ee3b02f14d6ca9c6284f8a364eb1060281cf8f2f14526b6105207e0677d444a398dab7d3521121b47ce93d1cd563b2e5063f4b0bdc6b7df27124ca0f9
SSDEEP 393216:RWyN2aigMqS7RxOPRFHU7LQdLN5ovdDrAnF3ELzzvaxUw+wFfnzEPifUriIHvuOS:RlduNEE3gULvmmrYPZUo8dyh
TLSH
T156D74A0666EA04C0FDF7EA3489F65513D677BC126F3185CF62081B2A1F776E0897A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
420	powershell.exe
4768	powershell.exe
1012	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1176	tasklist.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3152	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
420	powershell.exe
420	powershell.exe
4104	powershell.exe
4104	powershell.exe
4768	powershell.exe
4768	powershell.exe
1012	powershell.exe
1012	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4688	WMIC.exe
Token: SeSecurityPrivilege	4688	WMIC.exe
Token: SeTakeOwnershipPrivilege	4688	WMIC.exe
Token: SeLoadDriverPrivilege	4688	WMIC.exe
Token: SeSystemProfilePrivilege	4688	WMIC.exe
Token: SeSystemtimePrivilege	4688	WMIC.exe
Token: SeProfSingleProcessPrivilege	4688	WMIC.exe
Token: SeIncBasePriorityPrivilege	4688	WMIC.exe
Token: SeCreatePagefilePrivilege	4688	WMIC.exe
Token: SeBackupPrivilege	4688	WMIC.exe
Token: SeRestorePrivilege	4688	WMIC.exe
Token: SeShutdownPrivilege	4688	WMIC.exe
Token: SeDebugPrivilege	4688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4688	WMIC.exe
Token: SeRemoteShutdownPrivilege	4688	WMIC.exe
Token: SeUndockPrivilege	4688	WMIC.exe
Token: SeManageVolumePrivilege	4688	WMIC.exe
Token: 33	4688	WMIC.exe
Token: 34	4688	WMIC.exe
Token: 35	4688	WMIC.exe
Token: 36	4688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4688	WMIC.exe
Token: SeSecurityPrivilege	4688	WMIC.exe
Token: SeTakeOwnershipPrivilege	4688	WMIC.exe
Token: SeLoadDriverPrivilege	4688	WMIC.exe
Token: SeSystemProfilePrivilege	4688	WMIC.exe
Token: SeSystemtimePrivilege	4688	WMIC.exe
Token: SeProfSingleProcessPrivilege	4688	WMIC.exe
Token: SeIncBasePriorityPrivilege	4688	WMIC.exe
Token: SeCreatePagefilePrivilege	4688	WMIC.exe
Token: SeBackupPrivilege	4688	WMIC.exe
Token: SeRestorePrivilege	4688	WMIC.exe
Token: SeShutdownPrivilege	4688	WMIC.exe
Token: SeDebugPrivilege	4688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4688	WMIC.exe
Token: SeRemoteShutdownPrivilege	4688	WMIC.exe
Token: SeUndockPrivilege	4688	WMIC.exe
Token: SeManageVolumePrivilege	4688	WMIC.exe
Token: 33	4688	WMIC.exe
Token: 34	4688	WMIC.exe
Token: 35	4688	WMIC.exe
Token: 36	4688	WMIC.exe
Token: SeDebugPrivilege	1176	tasklist.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeIncreaseQuotaPrivilege	420	powershell.exe
Token: SeSecurityPrivilege	420	powershell.exe
Token: SeTakeOwnershipPrivilege	420	powershell.exe
Token: SeLoadDriverPrivilege	420	powershell.exe
Token: SeSystemProfilePrivilege	420	powershell.exe
Token: SeSystemtimePrivilege	420	powershell.exe
Token: SeProfSingleProcessPrivilege	420	powershell.exe
Token: SeIncBasePriorityPrivilege	420	powershell.exe
Token: SeCreatePagefilePrivilege	420	powershell.exe
Token: SeBackupPrivilege	420	powershell.exe
Token: SeRestorePrivilege	420	powershell.exe
Token: SeShutdownPrivilege	420	powershell.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeSystemEnvironmentPrivilege	420	powershell.exe
Token: SeRemoteShutdownPrivilege	420	powershell.exe
Token: SeUndockPrivilege	420	powershell.exe
Token: SeManageVolumePrivilege	420	powershell.exe
Token: 33	420	powershell.exe
Token: 34	420	powershell.exe
Token: 35	420	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2744	2604	Velocity.exe	89
PID 2744 wrote to memory of 4688	2744	cmd.exe	91
PID 2604 wrote to memory of 2208	2604	Velocity.exe	93
PID 2208 wrote to memory of 1176	2208	cmd.exe	95
PID 2604 wrote to memory of 2016	2604	Velocity.exe	96
PID 2016 wrote to memory of 420	2016	cmd.exe	98
PID 2604 wrote to memory of 3912	2604	Velocity.exe	99
PID 3912 wrote to memory of 220	3912	cmd.exe	101
PID 220 wrote to memory of 5004	220	net.exe	102
PID 2604 wrote to memory of 4308	2604	Velocity.exe	103
PID 4308 wrote to memory of 3152	4308	cmd.exe	105
PID 2604 wrote to memory of 1296	2604	Velocity.exe	106
PID 1296 wrote to memory of 4104	1296	cmd.exe	108
PID 2604 wrote to memory of 4672	2604	Velocity.exe	109
PID 4672 wrote to memory of 4768	4672	cmd.exe	111
PID 2604 wrote to memory of 3236	2604	Velocity.exe	114
PID 3236 wrote to memory of 1012	3236	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get Model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get Model
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:3152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -CoM"m"An"D" ""A"dD-"m"PpR"e"f"E"re"N"C"E" "-"Ex"C"LU"S"i"o"n"P"AT"H" 'C:\Users\'""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -CoM"m"An"D" ""A"dD-"m"PpR"e"f"E"re"N"C"E" "-"Ex"C"LU"S"i"o"n"P"AT"H" 'C:\Users\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e895f72838962d7a6ad7e5afac0c68424bfd83055dedf2d4f0ffba31a881f86f
MD5 779b03000ae11c7722622cd7368b4215
SHA1 68f10ffe2faaa50500c0c67d60ec42d2aa042d85
SHA512 b44e0e5e36079fa91bc17b4248072b1e32fb63badb8605f8e7537e0c540dd4f9f2efe12f973204e3549a52877dff1753a51534d911c8890b977fd5cab8dc5474
TLSH
T1A1216527B39CC821CC99153A209CAC1172B683C7809ECF8F6EC0D224A47FA84CB62694
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 3367baf6d28d601966ec6b2905587a1b8372d18f11a316ecf18e373f12c71a1a
MD5 57359e8a52af5b5eb6f81945c98fd001
SHA1 bd0fe9b90d9683c5bb7f45f794a230a271acbb91
SHA512 aa47fee216b36180327423051b6deb75c637c43c79bc9391f10683db34692eaf27b18e2a42aab2c0a5da87fe1c21b9a12ad5cfa10aacdd543c27dec263f52b86
TLSH
T1DA112223F38C89A1CC961639509DAC5172B686CB81AEDFDF7FC0C210E5AF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d6f331867a67cbb5e9f73fb7462964b8a64543fb1dfd168854e48d336428ce5f
MD5 e76ba9582214024475a33dc3bfc2273c
SHA1 cd6c86074b5ea1bb71567826e8affcbfb57b903f
SHA512 11c7cc98ad6c6e4606195ef24975d32acbb460466a5758f2839cae3408917ae38e583ecc8fb0e6ae9ca52f4c2ac42d6142bb5f4a256542838dfb158a40b269a5
TLSH
T145217827F3CC8A21CC95163A509D9C1176B282C7819FDF9F6FC0E201A5BF599CB71190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_l2lrujq4.dc3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l2lrujq4.dc3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-6-0x00000222C3CD0000-0x00000222C3CF2000-memory.dmp

Download

memory/420-9-0x00000222C4190000-0x00000222C41BA000-memory.dmp

Download

memory/420-10-0x00000222C4190000-0x00000222C41B4000-memory.dmp

Download