Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 03:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
chocoGUIv2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target chocoGUIv2.exe
- Size 1.1MB
- Sample261027-edagnsas91
- SHA256 47f1f9c1a285e647f94f91d9b509ed8c9a727f142b55199f6255041301e924b7
- MD5 adf0e50af48e65041aca98a2b40a576e
- SHA1 40b321f6aaa4491575f23db2baf8ff74e3cb1908
- SHA512 309efb4a436a080b1bb405c9fb95949da0337588eba4ea95aedb84ad96aac41d219c07c3c1e021a065e2a255ad12e1d9f154c1a6981c8533f2ab550c01f44db5
- SSDEEP 24576:MAHnh+eWsN3skA4RV1Hom2KXMmHaeyNm2s6JRtccO5:rh+ZkldoPK8Yaey0ZAi
- TLSH T13735AD0273D2C036FFAA92739B6AF20596BD79250133852F13981DB9BD701B1277E663
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://chocolatey.org/install.ps1
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 4876 powershell.exe 8 4876 powershell.exe -
pid Process 4876 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 940 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chocoGUIv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 powershell.exe 4876 powershell.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1768 chocoGUIv2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4876 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe 1768 chocoGUIv2.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1768 wrote to memory of 940 1768 chocoGUIv2.exe 88 PID 940 wrote to memory of 4876 940 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kmg13vkm.txo.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH