f34c59f784d43da6e633390d85d14ca60539b4676159444f313c62fcfc3b68dc

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 22:29

Target
Solara/Monaco/fileaccess/node_modules/toidentifier/package.json
Size 1KB
Sample260716-2d99maft2p
SHA256 f34c59f784d43da6e633390d85d14ca60539b4676159444f313c62fcfc3b68dc
MD5 fd6e2543a1b015cc443c7a2dcc4e3668
SHA1 e8fe1d02a381b71a33e41588ae26746d34fa4903
SHA512 c08da7b7852c9b297a29f6fb5dcf51a67b513caec17474acecbcf324c5615601fe99744bd49e90f0a21d8a5710abd58e78b4a89d9ca0e4b0b1f29584ba54b57e
TLSH
T14D213020C98A4CB352C88669786960C2246204874B82FE1DFBB5030D8F4D7BF50766FC
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4176	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Solara\Monaco\fileaccess\node_modules\toidentifier\package.json
1⤵
- Modifies registry class
PID:3472

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact