Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 03:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
chocoGUIv2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
chocoGUIv2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target chocoGUIv2.exe
- Size 1.1MB
- Sample261027-edefmabs5m
- SHA256 a3e93c6c9aa61979b12cb8200c7d9a4a02c323a1366f14b478e61de40b955a0c
- MD5 ec84a85a13b70d9996961e46fcd5dfa8
- SHA1 3f9168862c7bd112becda97cb9f04684c7dab12c
- SHA512 883259c05ed94fc2ad9481df1452958dac2fa70e5aada488a4fa086328314f4dc94d574639adb9ea3a3748c74fd26513c01848be7e59872458787e293b6f0fcd
- SSDEEP 24576:mfTkD0E003ubc2MRgCmP/ZwIDzq+Iha5a0HV1lNCr6nyPp:iG00SSgCmP/ZwYj48a011loIy
- TLSH T1AE458DA923EC43D8DA76E076FA52C707DEB3788A0674BB1B0DE04A765F13670161E352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://chocolatey.org/install.ps1
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 7 6108 powershell.exe 8 6108 powershell.exe -
pid Process 6108 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3608 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6108 powershell.exe 6108 powershell.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 996 chocoGUIv2.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 6108 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe 996 chocoGUIv2.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 996 wrote to memory of 3608 996 chocoGUIv2.exe 89 PID 3608 wrote to memory of 6108 3608 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"C:\Users\Admin\AppData\Local\Temp\chocoGUIv2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C @"%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))" && SET "PATH=%PATH%;%ALLUSERSPROFILE%\chocolatey\bin"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -InputFormat None -ExecutionPolicy Bypass -Command "iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6108
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yoint3rz.bv2.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH