Overview

overview

7

Static

static

1

LTspice64.msi

windows11-21h2-x64

7

Resubmissions

19/08/2026, 00:24

260819-aqevpstdph7

05/08/2026, 00:07

260805-aeeesstdlb8

30/07/2026, 23:55

260730-3yjsvahe747

Analysis

  • user interaction
    yes
  • max time kernel
    463s
  • max time network
    436s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/08/2026, 00:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LTspice64.msi
  • Size 170.0MB
  • Sample260819-aqevpstdph
  • SHA256 485dabd2d7d8293de733a399719f6538efda4a54b48b181a14e07271186984d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 42 IoCs
  • Badlisted process makes network request 64 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 20 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LTspice64.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4780
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7D460EC92E5455EB61FACB6D14D3D3F1 U
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Users\Admin\AppData\Local\Temp\MSI31400\EnhancedUI.exe
        EmbeddedUI.exe /embeddedui 4780
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4236
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C5448B12D247453B0D2BEDBDD086D132 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:6064
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 69B8517D77CAFA1D67065A76DAFE29F7 C
      2⤵
      • Loads dropped DLL
      PID:3948
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4732
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 795273246AC540059809BBA5F3BFF995
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1776
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2536
    • C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\LTspice.exe
      "C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\LTspice.exe"
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:608
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4584
      • C:\Users\Admin\AppData\Local\LTspice\Remove.exe
        "C:\Users\Admin\AppData\Local\LTspice\Remove.exe"
        1⤵
        • Executes dropped EXE
        PID:2208
      • C:\Users\Admin\AppData\Local\LTspice\Remove.exe
        "C:\Users\Admin\AppData\Local\LTspice\Remove.exe"
        1⤵
        • Executes dropped EXE
        PID:3640
      • C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\Remove.exe
        "C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\Remove.exe"
        1⤵
        • Executes dropped EXE
        PID:360
      • C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\Remove.exe
        "C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\Remove.exe"
        1⤵
        • Executes dropped EXE
        PID:3688

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58a3be.rbs
            • Path C:\Config.Msi\e58a3be.rbs
            • Size 1002KB
            • SHA256 bba883241e67a6352a614e8427f3c216e456518c776b9f4bea3dd2e79debcafa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tracking.ini
            • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\63d14d904a6e51432bb45eee\26.0.2.1\tracking.ini
            • Size 85B
            • SHA256 649f918bc8f6fa28d016f4a2a8a8a6edd307e28663ee2dea242e0565559a9bf5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            {B942423B-4FC3-44BA-A908-B922711ACE13}.session
            • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\63d14d904a6e51432bb45eee\26.0.2.1\{B942423B-4FC3-44BA-A908-B922711ACE13}.session
            • Size 35KB
            • SHA256 359930bbb6f929701abf606ee11f523fbd2036587cff343dc7ffc758b6e085f6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            {B942423B-4FC3-44BA-A908-B922711ACE13}.session
            • Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\63d14d904a6e51432bb45eee\26.0.2.1\{B942423B-4FC3-44BA-A908-B922711ACE13}.session
            • Size 45KB
            • SHA256 cb9ec018d55c150fced3d230aeef124a24cb1fd4d9a92825bf0c039839f901cf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LTM4682.asc
            • Path C:\Users\Admin\AppData\Local\LTspice\examples\Applications\LTM4682.asc
            • Size 9KB
            • SHA256 56c96a9aa47188dd60592a192799825c94ad393d72ec84195ef6068e7f3806b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ECB2R8M12YM3.asy
            • Path C:\Users\Admin\AppData\Local\LTspice\lib\sym\Contrib\Wolfspeed\Six_Pack\ECB2R8M12YM3.asy
            • Size 7KB
            • SHA256 e5ade9a6fca46932afab249582f87dcf50680c41220792217b40d81eff5a2255
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LT1993-10.asy
            • Path C:\Users\Admin\AppData\Local\LTspice\lib\sym\OpAmps\LT1993-10.asy
            • Size 5KB
            • SHA256 58d1b6f8e947ebb55c6b99f2bdca03f58e098c731a17edef2472a15cdc43ef4d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ADG5206.asy
            • Path C:\Users\Admin\AppData\Local\LTspice\lib\sym\Switches\ADG5206.asy
            • Size 5KB
            • SHA256 799e3b55ea98c4e2172b9eb228d9a0e4309415ccc24604af104a90ab22630fac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MAX306.asy
            • Path C:\Users\Admin\AppData\Local\LTspice\lib\sym\Switches\MAX306.asy
            • Size 5KB
            • SHA256 c4a8fc3426eb66f7009dbe4ebc1741f2ef7c2097ce28a39a176081f95bf64265
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            toc104.new.js
            • Path C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\LTspiceHelp\whxdata\toc104.new.js
            • Size 116B
            • SHA256 8a7fa39a54d68cf7a0220b34958dbbee195a4496fd9f11677d47a9b85dd96671
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            updater.ini
            • Path C:\Users\Admin\AppData\Local\Programs\ADI\LTspice\updater.ini
            • Size 199B
            • SHA256 0e663274dd37cc638f3869d81d64e7b383f5aded4d84a87846f125473b752741
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            banner.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4236\banner.jpg
            • Size 2KB
            • SHA256 633c433a21bb465c5e710e92bd0e43fd36e1fa65907724b2c56dc69892c46ea3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            dialog.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4236\dialog.jpg
            • Size 18KB
            • SHA256 17985fd337f91fe7477e6b806740104eb17ccc0a984dee7b8078cb9b18a63cfd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI1C43.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI1C43.tmp
            • Size 102KB
            • SHA256 b402c9f8479cbdb2ada20974c78f68f1ddc668dda15ad136cd477ae37a1faadc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI1CA3.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI1CA3.tmp
            • Size 1.2MB
            • SHA256 9b92a0ea7541d8b1fe9864d14ccf4f30badedbbb7689e9275b2c77edf5fcda9e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            EnhancedUI.exe
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\EnhancedUI.exe
            • Size 4.4MB
            • SHA256 c912d4e6d65dc4c1fd960c15575279288df5d566db639d101126f59d29e70c4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InstallerAnalytics.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\InstallerAnalytics.dll
            • Size 1.2MB
            • SHA256 9b4cdf653effdcfc8ae7e776a00b8609e7de8de4b382bf84ba43b8e4452fb096
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSVCP140_APP.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\MSVCP140_APP.dll
            • Size 243KB
            • SHA256 bb552c9477acf8cf6c7202a039cde7ee04948625ae8eb7bdc5922aaf951a734f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Toolkit.Win32.UI.XamlHost.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\Microsoft.Toolkit.Win32.UI.XamlHost.dll
            • Size 101KB
            • SHA256 dd136f1fd23e91866a53b9e9a0f28c83fa63c2aee01e61b3fc280e8f8fe549ca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.UI.Xaml.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\Microsoft.UI.Xaml.dll
            • Size 5.4MB
            • SHA256 9c2b2585b9d75e302002c8dafe60871196ffe059855747d63843c7a570a4ee7e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_APP.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\VCRUNTIME140_APP.dll
            • Size 18KB
            • SHA256 372c955ee558f4ef733acbd801d1fc6082539fce9d8a14a584b6ee131f3142fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WinUiBootstrapperEui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\WinUiBootstrapperEui.dll
            • Size 192KB
            • SHA256 c0ad06dadfc6ea12086345fefd17b49742d5a67a0e2ac1637fca25685549cf54
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            embeddeduiproxy.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\embeddeduiproxy.dll
            • Size 434KB
            • SHA256 504b0fb3639280b588fa468b03a29ddb3c066a632cc3f592dbb7c3f12e52ccf6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msvcp140.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\msvcp140.DLL
            • Size 439KB
            • SHA256 c8e7456f4ac9aa65ef3ad61a6daf30efec9737344d173b2d6d2c16e752052a55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.pri
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\resources.pri
            • Size 18.1MB
            • SHA256 63bb54c55345815b32d417c3d6b63dc24c07bdb0e090297193c50816e6d2470e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\MSI31400\vcruntime140.dll
            • Size 88KB
            • SHA256 eb6a3a491efcc911f9dff457d42fed85c4c170139414470ea951b0dafe352829
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            aic13D1.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\aic13D1.tmp
            • Size 1.2MB
            • SHA256 15694917b403fc11ffe7d02bb3877a91895ee082efbd2d85e8a50338ca70a7fc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmp3
            • Path C:\Users\Admin\AppData\Local\Temp\tmp3
            • Size 223KB
            • SHA256 aec4b00b51ccba2e68cbec6463fff415afa54d2577126c8b053efc75c1d13daa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmp3
            • Path C:\Users\Admin\AppData\Local\Temp\tmp3
            • Size 4.8MB
            • SHA256 e317ef9a2e9b6aa11ea89669e5421bfda66f3779536893bef069392f35969c50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmp3
            • Path C:\Users\Admin\AppData\Local\Temp\tmp3
            • Size 13.9MB
            • SHA256 c4063d40f1d9a2b50067334898f9437c1e44515e81a8d0274073eb9f7e3bd40b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmp3
            • Path C:\Users\Admin\AppData\Local\Temp\tmp3
            • Size 588B
            • SHA256 2c613c9b0c8c346e4f8756e494b79e6f5ca589512b0a4220f743c73784ce6b31
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tmp8
            • Path C:\Users\Admin\AppData\Local\Temp\tmp8
            • Size 113KB
            • SHA256 68b3bd6880a5fb3d02203638ec942349f1826661774b60da4da8ba9a079506b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LTspice.ini
            • Path C:\Users\Admin\AppData\Roaming\LTspice.ini
            • Size 61B
            • SHA256 e4c2790a40232c1b037d8ffeed78ef3fc103a3f0f58861ce2bdab510eea52b74
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LTspice.ini
            • Path C:\Users\Admin\AppData\Roaming\LTspice.ini
            • Size 9KB
            • SHA256 20186e07ce64390d50c7ec41a61d7dc3059994ef798f5fffd69363a7f0e6cdbc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download