Analysis
- user interaction
yes - max time kernel
286s - max time network
249s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/10/2026, 09:36
General
- Target 7_LastLight.zip
- Size 83.4MB
- Sample261030-llbs2aeb33
- SHA256 70bf7a1b14380fc3aceb43b67adfdea7fa3fd9340ceb05e08cd6c45b52e18410
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\7_LastLight.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\7_LastLight\" -spe -an -ai#7zMap23930:102:7zEvent24801⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7_LastLight\LastLight.exe"C:\Users\Admin\AppData\Local\Temp\7_LastLight\LastLight.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7_LastLight\LastLight.exe"C:\Users\Admin\AppData\Local\Temp\7_LastLight\LastLight.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7_LastLight\game.log1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7_LastLight\LastLight.exeLastLight.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7_LastLight\game.log1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
LastLight.exe
game.log
memory/3760-25-0x00007FFF25720000-0x00007FFF25722000-memory.dmp
memory/3760-32-0x00007FFF25790000-0x00007FFF25792000-memory.dmp
memory/3760-15-0x00007FFF24FB0000-0x00007FFF24FB2000-memory.dmp
memory/3760-16-0x00007FFF233E0000-0x00007FFF233E2000-memory.dmp
memory/3760-17-0x00007FFF233F0000-0x00007FFF233F2000-memory.dmp
memory/3760-18-0x00007FFF256B0000-0x00007FFF256B2000-memory.dmp
memory/3760-19-0x00007FFF256C0000-0x00007FFF256C2000-memory.dmp
memory/3760-20-0x00007FFF256D0000-0x00007FFF256D2000-memory.dmp
memory/3760-21-0x00007FFF256E0000-0x00007FFF256E2000-memory.dmp
memory/3760-22-0x00007FFF256F0000-0x00007FFF256F2000-memory.dmp
memory/3760-23-0x00007FFF25700000-0x00007FFF25702000-memory.dmp
memory/3760-24-0x00007FFF25710000-0x00007FFF25712000-memory.dmp
memory/3760-13-0x00007FFF256A0000-0x00007FFF256A2000-memory.dmp
memory/3760-26-0x00007FFF25730000-0x00007FFF25732000-memory.dmp
memory/3760-14-0x00007FFF24FA0000-0x00007FFF24FA2000-memory.dmp
memory/3760-29-0x00007FFF25760000-0x00007FFF25762000-memory.dmp
memory/3760-27-0x00007FFF25740000-0x00007FFF25742000-memory.dmp
memory/3760-30-0x00007FFF25770000-0x00007FFF25772000-memory.dmp
memory/3760-31-0x00007FFF25780000-0x00007FFF25782000-memory.dmp
memory/3760-28-0x00007FFF25750000-0x00007FFF25752000-memory.dmp
memory/3760-33-0x00007FFF257A0000-0x00007FFF257A2000-memory.dmp
memory/3760-34-0x00007FFF257B0000-0x00007FFF257B2000-memory.dmp
memory/3760-35-0x00007FF739B90000-0x00007FF73FB14000-memory.dmp
memory/3760-41-0x00007FF739B90000-0x00007FF73FB14000-memory.dmp
memory/3760-43-0x0000017DBC600000-0x0000017DBC627000-memory.dmp
memory/3760-12-0x00007FFF25690000-0x00007FFF25692000-memory.dmp
memory/5380-75-0x00007FF739B90000-0x00007FF73FB14000-memory.dmp
memory/5380-77-0x000001318BF90000-0x000001318BFB7000-memory.dmp
memory/5380-71-0x00007FF739B90000-0x00007FF73FB14000-memory.dmp