Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 03:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
chocoGUIv2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target chocoGUIv2.exe
- Size 1024KB
- Sample261027-edc8kaat2x
- SHA256 410a660ee312e7adba51e44616e102d6dda224922242d4f41c6e24dc014ccd58
- MD5 d5637fbc718d8799c9cdbadf8e9428b4
- SHA1 813aa27cfca8b48ee69ed888e3cc808c4f663a44
- SHA512 aadff8c245d2128f3410fae8e053d59ebf64b6e22dae45dda69f131cf96a7d64b0188269695809b20de44a0136a287b427ab74cefa34ea31f8af6de7df91dd46
- SSDEEP 24576:NCdxte/80jYLT3U1jfsWa2TodDxfotip0nBQ:Ew80cTsjkWa2EdDxVp0K
- TLSH T1C725BE2273DDC360CBB69173BF69B3016EBF78620634B85B2F980D79A950171162D7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://chocolatey.org/install.ps1
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 2228 powershell.exe 8 2228 powershell.exe -
pid Process 2228 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4196 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chocoGUIv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2228 powershell.exe 2228 powershell.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4148 chocoGUIv2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2228 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe 4148 chocoGUIv2.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4148 wrote to memory of 4196 4148 chocoGUIv2.exe 90 PID 4196 wrote to memory of 2228 4196 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0hhb5d3k.utv.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH