Analysis
- max time kernel
148s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 03:49
General
- Target chocoGUIv2.exe
- Size 1.1MB
- Sample261027-edca9sat2v
- SHA256 0819f07839c867fbe540685a21c59517b417e8af88d883805f4cca97c0fe3c4a
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://chocolatey.org/install.ps1
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of FindShellTrayWindow 48 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"3⤵
- Badlisted process makes network request
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754656889071784⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754656934378664⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754656976565274⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\setx.exe"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate 1343754657171882454⤵
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\chocolatey\choco.exe"C:\ProgramData\chocolatey\choco.exe" -v4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
-
C:\ProgramData\chocolatey\choco.exeC:\ProgramData\chocolatey\choco.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\chocolatey\choco.exeC:\ProgramData\chocolatey\choco.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CREDITS.json
CREDITS.pdf
CREDITS.txt
LICENSE.txt
choco.exe.manifest
chocolatey.config
chocolatey.config
Chocolatey.PowerShell.dll-help.xml
ChocolateyTabExpansion.ps1
chocolateyProfile.psm1
chocolateyScriptRunner.ps1
chocolatey.nupkg
choco.summary.log
choco.summary.log
chocolatey.log
chocolatey.log
chocolatey.log
chocolatey.log
chocolatey.log
RefreshEnv.cmd
choco.exe
choco.exe.ignore
7z.dll
7z.exe
7zip.license.txt
checksum.exe
checksum.exe.config
checksum.license.txt
shimgen.exe
shimgen.license.txt
choco.exe.log
__PSScriptPolicyTest_rwfwvbhu.tss.ps1
choco.exe
Chocolatey.PowerShell.dll
chocolateyInstaller.psm1
Format-FileSize.ps1
Get-CheckSumValid.ps1
Get-ChocolateyConfigValue.ps1
Get-ChocolateyPath.ps1
Get-ChocolateyUnzip.ps1
Get-ChocolateyWebFile.ps1
Get-FtpFile.ps1
Get-OSArchitectureWidth.ps1
Get-PackageParameters.ps1
Get-ToolsLocation.ps1
Get-UACEnabled.ps1
Get-UninstallRegistryKey.ps1
Get-VirusCheckValid.ps1
Get-WebFile.ps1
Get-WebFileName.ps1
Get-WebHeaders.ps1
Install-BinFile.ps1
Install-ChocolateyEnvironmentVariable.ps1
Install-ChocolateyExplorerMenuItem.ps1
Install-ChocolateyFileAssociation.ps1
Install-ChocolateyInstallPackage.ps1
Install-ChocolateyPackage.ps1
Install-ChocolateyPinnedTaskBarItem.ps1
Install-ChocolateyPowershellCommand.ps1
Install-ChocolateyShortcut.ps1
Install-ChocolateyVsixPackage.ps1
Install-ChocolateyZipPackage.ps1
Install-Vsix.ps1
Set-PowerShellExitCode.ps1
Start-ChocolateyProcessAsAdmin.ps1
UnInstall-ChocolateyZipPackage.ps1
Uninstall-BinFile.ps1
Uninstall-ChocolateyEnvironmentVariable.ps1
Uninstall-ChocolateyPackage.ps1
Write-FunctionCallLogMessage.ps1
7z.exe.manifest
memory/3676-29-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-30-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-41-0x00000000086B0000-0x00000000086D2000-memory.dmp
memory/3676-42-0x0000000008D40000-0x00000000092E4000-memory.dmp
memory/3676-44-0x0000000008860000-0x0000000008872000-memory.dmp
memory/3676-45-0x0000000008850000-0x000000000885A000-memory.dmp
memory/3676-48-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-71-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-39-0x00000000086D0000-0x00000000086EA000-memory.dmp
memory/3676-226-0x0000000007DD0000-0x0000000007DDE000-memory.dmp
memory/3676-229-0x000000007FAB0000-0x000000007FAC0000-memory.dmp
memory/3676-258-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-259-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-0-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-38-0x0000000008680000-0x0000000008694000-memory.dmp
memory/3676-37-0x0000000008670000-0x000000000867E000-memory.dmp
memory/3676-36-0x0000000008650000-0x0000000008661000-memory.dmp
memory/3676-260-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-34-0x0000000008610000-0x000000000861A000-memory.dmp
memory/3676-33-0x0000000007E90000-0x0000000007F33000-memory.dmp
memory/3676-40-0x00000000086C0000-0x00000000086C8000-memory.dmp
memory/3676-21-0x0000000070360000-0x00000000703AC000-memory.dmp
memory/3676-35-0x00000000086F0000-0x0000000008786000-memory.dmp
memory/3676-31-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-32-0x0000000007E60000-0x0000000007E7E000-memory.dmp
memory/3676-20-0x0000000007E20000-0x0000000007E52000-memory.dmp
memory/3676-19-0x000000007FAB0000-0x000000007FAC0000-memory.dmp
memory/3676-18-0x0000000006E40000-0x0000000006E5A000-memory.dmp
memory/3676-1-0x0000000003320000-0x0000000003356000-memory.dmp
memory/3676-17-0x0000000007F70000-0x00000000085EA000-memory.dmp
memory/3676-2-0x00000000033F0000-0x0000000003400000-memory.dmp
memory/3676-3-0x0000000005A70000-0x0000000006098000-memory.dmp
memory/3676-16-0x0000000006940000-0x000000000698C000-memory.dmp
memory/3676-15-0x0000000006900000-0x000000000691E000-memory.dmp
memory/3676-4-0x0000000005960000-0x0000000005982000-memory.dmp
memory/3676-5-0x0000000006250000-0x00000000062B6000-memory.dmp
memory/3676-14-0x0000000006430000-0x0000000006784000-memory.dmp
memory/3676-6-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/6036-522-0x000002322AFE0000-0x000002322AFFE000-memory.dmp
memory/6036-521-0x000002322D220000-0x000002322D296000-memory.dmp
memory/6036-482-0x000002322B050000-0x000002322B072000-memory.dmp
memory/6036-481-0x000002322B000000-0x000002322B050000-memory.dmp
memory/6036-468-0x000002320F530000-0x00000232100A8000-memory.dmp