34e342d2799a3c81397b7198c57696017c95c68fa9d1bde9f52124d5c01beea2

Analysis

user interaction
yes
max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Velocity.exe
Size 60.4MB
Sample260620-bgh2facx2j
SHA256 34e342d2799a3c81397b7198c57696017c95c68fa9d1bde9f52124d5c01beea2
MD5 18783821c819bcff52ad53ca97a59c11
SHA1 4211c6dd2b372aa88713670770ab430b9b11a993
SHA512 53e4988ee3b02f14d6ca9c6284f8a364eb1060281cf8f2f14526b6105207e0677d444a398dab7d3521121b47ce93d1cd563b2e5063f4b0bdc6b7df27124ca0f9
SSDEEP 393216:RWyN2aigMqS7RxOPRFHU7LQdLN5ovdDrAnF3ELzzvaxUw+wFfnzEPifUriIHvuOS:RlduNEE3gULvmmrYPZUo8dyh
TLSH
T156D74A0666EA04C0FDF7EA3489F65513D677BC126F3185CF62081B2A1F776E0897A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
4216	powershell.exe
3884	powershell.exe
2676	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2120	tasklist.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5508	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2204	WMIC.exe
2204	WMIC.exe
2204	WMIC.exe
2204	WMIC.exe
3884	powershell.exe
3884	powershell.exe
4760	powershell.exe
4760	powershell.exe
2676	powershell.exe
2676	powershell.exe
4216	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2204	WMIC.exe
Token: SeSecurityPrivilege	2204	WMIC.exe
Token: SeTakeOwnershipPrivilege	2204	WMIC.exe
Token: SeLoadDriverPrivilege	2204	WMIC.exe
Token: SeSystemProfilePrivilege	2204	WMIC.exe
Token: SeSystemtimePrivilege	2204	WMIC.exe
Token: SeProfSingleProcessPrivilege	2204	WMIC.exe
Token: SeIncBasePriorityPrivilege	2204	WMIC.exe
Token: SeCreatePagefilePrivilege	2204	WMIC.exe
Token: SeBackupPrivilege	2204	WMIC.exe
Token: SeRestorePrivilege	2204	WMIC.exe
Token: SeShutdownPrivilege	2204	WMIC.exe
Token: SeDebugPrivilege	2204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2204	WMIC.exe
Token: SeRemoteShutdownPrivilege	2204	WMIC.exe
Token: SeUndockPrivilege	2204	WMIC.exe
Token: SeManageVolumePrivilege	2204	WMIC.exe
Token: 33	2204	WMIC.exe
Token: 34	2204	WMIC.exe
Token: 35	2204	WMIC.exe
Token: 36	2204	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2204	WMIC.exe
Token: SeSecurityPrivilege	2204	WMIC.exe
Token: SeTakeOwnershipPrivilege	2204	WMIC.exe
Token: SeLoadDriverPrivilege	2204	WMIC.exe
Token: SeSystemProfilePrivilege	2204	WMIC.exe
Token: SeSystemtimePrivilege	2204	WMIC.exe
Token: SeProfSingleProcessPrivilege	2204	WMIC.exe
Token: SeIncBasePriorityPrivilege	2204	WMIC.exe
Token: SeCreatePagefilePrivilege	2204	WMIC.exe
Token: SeBackupPrivilege	2204	WMIC.exe
Token: SeRestorePrivilege	2204	WMIC.exe
Token: SeShutdownPrivilege	2204	WMIC.exe
Token: SeDebugPrivilege	2204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2204	WMIC.exe
Token: SeRemoteShutdownPrivilege	2204	WMIC.exe
Token: SeUndockPrivilege	2204	WMIC.exe
Token: SeManageVolumePrivilege	2204	WMIC.exe
Token: 33	2204	WMIC.exe
Token: 34	2204	WMIC.exe
Token: 35	2204	WMIC.exe
Token: 36	2204	WMIC.exe
Token: SeDebugPrivilege	2120	tasklist.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeIncreaseQuotaPrivilege	3884	powershell.exe
Token: SeSecurityPrivilege	3884	powershell.exe
Token: SeTakeOwnershipPrivilege	3884	powershell.exe
Token: SeLoadDriverPrivilege	3884	powershell.exe
Token: SeSystemProfilePrivilege	3884	powershell.exe
Token: SeSystemtimePrivilege	3884	powershell.exe
Token: SeProfSingleProcessPrivilege	3884	powershell.exe
Token: SeIncBasePriorityPrivilege	3884	powershell.exe
Token: SeCreatePagefilePrivilege	3884	powershell.exe
Token: SeBackupPrivilege	3884	powershell.exe
Token: SeRestorePrivilege	3884	powershell.exe
Token: SeShutdownPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeSystemEnvironmentPrivilege	3884	powershell.exe
Token: SeRemoteShutdownPrivilege	3884	powershell.exe
Token: SeUndockPrivilege	3884	powershell.exe
Token: SeManageVolumePrivilege	3884	powershell.exe
Token: 33	3884	powershell.exe
Token: 34	3884	powershell.exe
Token: 35	3884	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5864 wrote to memory of 1240	5864	Velocity.exe	88
PID 1240 wrote to memory of 2204	1240	cmd.exe	90
PID 5864 wrote to memory of 4580	5864	Velocity.exe	92
PID 4580 wrote to memory of 2120	4580	cmd.exe	94
PID 5864 wrote to memory of 4508	5864	Velocity.exe	95
PID 4508 wrote to memory of 3884	4508	cmd.exe	97
PID 5864 wrote to memory of 4656	5864	Velocity.exe	98
PID 4656 wrote to memory of 4604	4656	cmd.exe	100
PID 4604 wrote to memory of 4972	4604	net.exe	101
PID 5864 wrote to memory of 4288	5864	Velocity.exe	102
PID 4288 wrote to memory of 5508	4288	cmd.exe	104
PID 5864 wrote to memory of 3756	5864	Velocity.exe	105
PID 3756 wrote to memory of 4760	3756	cmd.exe	107
PID 5864 wrote to memory of 2556	5864	Velocity.exe	109
PID 2556 wrote to memory of 2676	2556	cmd.exe	111
PID 5864 wrote to memory of 780	5864	Velocity.exe	112
PID 780 wrote to memory of 4216	780	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\Velocity.exe
"C:\Users\Admin\AppData\Local\Temp\Velocity.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get Model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get Model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    PID:5508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "-"cO"m"M ""a"D"d"-"m"p"p"r"E"f"E"r"e"n"c"E" "-"Ex"c"l"U"s"I"ONPaT"H" 'C:\Users\'""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "-"cO"m"M ""a"D"d"-"m"p"p"r"E"f"E"r"e"n"c"E" "-"Ex"c"l"U"s"I"ONPaT"H" 'C:\Users\'"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 527deb4e909f0e0c2d73da13cd44e3ddff73a12e9e5b976d619a59a078245730
MD5 7de8b795109efe1d9e626c6c9027898d
SHA1 1590c49ad3c026946e5814b7b7f2a6b6507ce270
SHA512 af15b3a31ff631bd79f905fc4672e3fe369a3b8a2a32f41a781b3002c0efbe642b9a8ac439e35c57798ff2d16fa6aefea78d0e53c0dd0cb09a7e39c8266317b6
TLSH
T1A9216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8125de213453fb8ef33984f918a3f2d3fdc492e3c800a632ad0e520990f1c361
MD5 edf993a5118cce9434aafae6fc333217
SHA1 d080936bfbc764b6564d77e1eb136e34c569d5d0
SHA512 aca80c753de64d21548315b43d0ca9b95458349832c15a390368148f9ee1ee9ba62a83edfdd2e53c84fdc575c18da6432a29df5e2a91d4fe4017780880504045
TLSH
T14A218633F3CC8720C88A403650CEAC1036B687CB408EDE6BBB84D044B52F698CE60260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_q4uobvds.qd5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4uobvds.qd5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3884-3-0x0000028E596A0000-0x0000028E596C2000-memory.dmp

Download

memory/3884-6-0x0000028E59720000-0x0000028E5973E000-memory.dmp

Download

memory/3884-7-0x0000028E599A0000-0x0000028E59A52000-memory.dmp

Download

memory/3884-8-0x0000028E59740000-0x0000028E5974A000-memory.dmp

Download

memory/3884-10-0x0000028E59BB0000-0x0000028E59BD4000-memory.dmp

Download

memory/3884-9-0x0000028E59BB0000-0x0000028E59BDA000-memory.dmp

Download