Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 03:48
General
- Target chocoGUIv2.exe
- Size 1.1MB
- Sample261027-ec9kdacf36
- SHA256 3f73f4eeffe82e158e9368319a29fb04794ee13271a61c828270eb9b7f7a2891
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://chocolatey.org/install.ps1
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 48 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754655954933824⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754656000243954⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754656043993134⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754656245556534⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" -v4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\ProgramData\chocolatey\choco.exeC:\ProgramData\chocolatey\choco.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\chocolatey\choco.exeC:\ProgramData\chocolatey\choco.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CREDITS.json
CREDITS.pdf
CREDITS.txt
LICENSE.txt
choco.exe.manifest
chocolatey.config
chocolatey.config
Chocolatey.PowerShell.dll-help.xml
ChocolateyTabExpansion.ps1
chocolateyProfile.psm1
chocolateyScriptRunner.ps1
chocolatey.nupkg
choco.summary.log
choco.summary.log
chocolatey.log
chocolatey.log
chocolatey.log
chocolatey.log
chocolatey.log
chocolatey.log
RefreshEnv.cmd
choco.exe
choco.exe.ignore
7z.dll
7z.exe
7zip.license.txt
checksum.exe
checksum.exe.config
checksum.license.txt
shimgen.exe
shimgen.license.txt
choco.exe.log
__PSScriptPolicyTest_edjleb52.zk1.ps1
choco.exe
Chocolatey.PowerShell.dll
chocolateyInstaller.psm1
Format-FileSize.ps1
Get-CheckSumValid.ps1
Get-ChocolateyConfigValue.ps1
Get-ChocolateyPath.ps1
Get-ChocolateyUnzip.ps1
Get-ChocolateyWebFile.ps1
Get-FtpFile.ps1
Get-OSArchitectureWidth.ps1
Get-PackageParameters.ps1
Get-ToolsLocation.ps1
Get-UACEnabled.ps1
Get-UninstallRegistryKey.ps1
Get-VirusCheckValid.ps1
Get-WebFile.ps1
Get-WebFileName.ps1
Get-WebHeaders.ps1
Install-BinFile.ps1
Install-ChocolateyEnvironmentVariable.ps1
Install-ChocolateyExplorerMenuItem.ps1
Install-ChocolateyFileAssociation.ps1
Install-ChocolateyInstallPackage.ps1
Install-ChocolateyPackage.ps1
Install-ChocolateyPinnedTaskBarItem.ps1
Install-ChocolateyPowershellCommand.ps1
Install-ChocolateyShortcut.ps1
Install-ChocolateyVsixPackage.ps1
Install-ChocolateyZipPackage.ps1
Install-Vsix.ps1
Set-PowerShellExitCode.ps1
Start-ChocolateyProcessAsAdmin.ps1
UnInstall-ChocolateyZipPackage.ps1
Uninstall-BinFile.ps1
Uninstall-ChocolateyEnvironmentVariable.ps1
Uninstall-ChocolateyPackage.ps1
Write-FunctionCallLogMessage.ps1
7z.exe.manifest
memory/1056-35-0x0000000007F10000-0x0000000007FA6000-memory.dmp
memory/1056-21-0x000000006FE60000-0x000000006FEAC000-memory.dmp
memory/1056-42-0x0000000008C50000-0x00000000091F4000-memory.dmp
memory/1056-41-0x0000000007ED0000-0x0000000007EF2000-memory.dmp
memory/1056-40-0x0000000007EE0000-0x0000000007EE8000-memory.dmp
memory/1056-45-0x00000000086E0000-0x00000000086F2000-memory.dmp
memory/1056-46-0x0000000007C60000-0x0000000007C6A000-memory.dmp
memory/1056-61-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-226-0x0000000008720000-0x000000000872E000-memory.dmp
memory/1056-229-0x000000007F350000-0x000000007F360000-memory.dmp
memory/1056-230-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-231-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-0-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-39-0x0000000007EF0000-0x0000000007F0A000-memory.dmp
memory/1056-38-0x0000000007EA0000-0x0000000007EB4000-memory.dmp
memory/1056-37-0x0000000007E90000-0x0000000007E9E000-memory.dmp
memory/1056-36-0x0000000007E70000-0x0000000007E81000-memory.dmp
memory/1056-232-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-34-0x0000000007E30000-0x0000000007E3A000-memory.dmp
memory/1056-33-0x0000000007D30000-0x0000000007DD3000-memory.dmp
memory/1056-32-0x0000000007D00000-0x0000000007D1E000-memory.dmp
memory/1056-44-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-23-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-24-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-25-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-20-0x0000000007CC0000-0x0000000007CF2000-memory.dmp
memory/1056-19-0x000000007F350000-0x000000007F360000-memory.dmp
memory/1056-1-0x00000000031E0000-0x0000000003216000-memory.dmp
memory/1056-18-0x0000000006CD0000-0x0000000006CEA000-memory.dmp
memory/1056-17-0x0000000008020000-0x000000000869A000-memory.dmp
memory/1056-2-0x00000000032A0000-0x00000000032B0000-memory.dmp
memory/1056-3-0x00000000058F0000-0x0000000005F18000-memory.dmp
memory/1056-16-0x00000000067F0000-0x000000000683C000-memory.dmp
memory/1056-15-0x00000000067B0000-0x00000000067CE000-memory.dmp
memory/1056-4-0x00000000057F0000-0x0000000005812000-memory.dmp
memory/1056-5-0x00000000060D0000-0x0000000006136000-memory.dmp
memory/1056-14-0x0000000006320000-0x0000000006674000-memory.dmp
memory/1056-6-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/3560-523-0x0000023645A70000-0x0000023645A8E000-memory.dmp
memory/3560-522-0x000002365EDE0000-0x000002365EE56000-memory.dmp
memory/3560-482-0x0000023645AB0000-0x0000023645AD2000-memory.dmp
memory/3560-481-0x000002365ECA0000-0x000002365ECF0000-memory.dmp
memory/3560-468-0x0000023643320000-0x0000023643E98000-memory.dmp