Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 03:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
chocoGUIv2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target chocoGUIv2.exe
- Size 1.1MB
- Sample261027-edca9sat2v
- SHA256 0819f07839c867fbe540685a21c59517b417e8af88d883805f4cca97c0fe3c4a
- MD5 b295bc2bd77d2b2db324dfce30d16f26
- SHA1 3ecd5d41cc682675f63d24bfc79bb44075eccdcb
- SHA512 b7944760a3b61f5ad70f504c895b7d5cf062c84389ddddfe4f86de2539b34cfc38a6211b73358b01d933dd4209b1a78bbac2ddd51dc9c139d117d531450a0ef1
- SSDEEP 24576:PAHnh+eWsN3skA4RV1Hom2KXMmHavBNm2s6Je35:yh+ZkldoPK8YavB0ZR
- TLSH T1F335AD0273D6C036FFAA92739B6AF20596BD79250133852F13981DB9BD701B1273E663
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://chocolatey.org/install.ps1
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 4256 powershell.exe 8 4256 powershell.exe -
pid Process 4256 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4452 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chocoGUIv2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4256 powershell.exe 4256 powershell.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5860 chocoGUIv2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4256 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe 5860 chocoGUIv2.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5860 wrote to memory of 4452 5860 chocoGUIv2.exe 89 PID 4452 wrote to memory of 4256 4452 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_smcjla1i.kdr.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH