Overview

overview

8

Static

static

3

1.-LTTS7 E...on.exe

windows10-2004-x64

7

1.-LTTS7 E...on.exe

windows11-ltsc_2024-x64

7

1.-LTTS7 E...pi.exe

windows10-2004-x64

7

1.-LTTS7 E...pi.exe

windows11-ltsc_2024-x64

8

2.-LOQUEND... 7.exe

windows10-2004-x64

7

2.-LOQUEND... 7.exe

windows11-ltsc_2024-x64

6

3.-LTTS7 S...on.exe

windows10-2004-x64

7

3.-LTTS7 S...on.exe

windows11-ltsc_2024-x64

6

4.-Parche ...ch.exe

windows10-2004-x64

3

4.-Parche ...ch.exe

windows11-ltsc_2024-x64

3

English Di...S7.exe

windows10-2004-x64

7

English Di...S7.exe

windows11-ltsc_2024-x64

6

m3troid300.url

windows10-2004-x64

4

m3troid300.url

windows11-ltsc_2024-x64

4

French Dis...S7.exe

windows10-2004-x64

7

French Dis...S7.exe

windows11-ltsc_2024-x64

6

m3troid300.url

windows10-2004-x64

4

m3troid300.url

windows11-ltsc_2024-x64

4

Galician D....0.exe

windows10-2004-x64

7

Galician D....0.exe

windows11-ltsc_2024-x64

6

m3troid300.url

windows10-2004-x64

4

m3troid300.url

windows11-ltsc_2024-x64

4

Loquendo T...al.pdf

windows10-2004-x64

3

Loquendo T...al.pdf

windows11-ltsc_2024-x64

3

Loquendo_T....1.exe

windows10-2004-x64

7

Loquendo_T....1.exe

windows11-ltsc_2024-x64

6

PORTUGUESE...S7.exe

windows10-2004-x64

7

PORTUGUESE...S7.exe

windows11-ltsc_2024-x64

6

m3troid300.url

windows10-2004-x64

4

m3troid300.url

windows11-ltsc_2024-x64

4

Rusian Dis...S7.exe

windows10-2004-x64

7

Rusian Dis...S7.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 21:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1.-LTTS7 Engine Full Distribution/LTTS7 Engine Full Distribution.exe
  • Size 14.8MB
  • Sample260928-1wafaadd76
  • SHA256 2bcaaae78e79d37e344760e51b3fabde018101ffabb2505daf47c5d5a35191ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomware

Malware Config

Signatures

  • Loads dropped DLL 21 IoCs
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 28 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.-LTTS7 Engine Full Distribution\LTTS7 Engine Full Distribution.exe
    "C:\Users\Admin\AppData\Local\Temp\1.-LTTS7 Engine Full Distribution\LTTS7 Engine Full Distribution.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /L*v c:\LTTS_7-EngineFull.log /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS16096EE733434835B9AFC63492BD89B3_7_5_0.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\1.-LTTS7 Engine Full Distribution\LTTS7 Engine Full Distribution.exe"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:3228
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5232
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2FCFACE09ACD7D9053CAAA87BF38CF58 C
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4196
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:6056
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7.ocx"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4892
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7SAPI4.dll"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3872
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7SAPI5.dll"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4716
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding BE2EFCB3A5CF298B21D99645D196058A
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7SAPI5.dll"
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2528
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2160

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e59f39e.rbs
          • Path C:\Config.Msi\e59f39e.rbs
          • Size 33KB
          • SHA256 2a4d8fd7038beeb47b1f1e6abcb2406a9a36afd2a0c8028c46b1a77fa255b9d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WIS16096EE733434835B9AFC63492BD89B3_7_5_0.MSI
          • Path C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS16096EE733434835B9AFC63492BD89B3_7_5_0.MSI
          • Size 14.8MB
          • SHA256 7bcf1e131c8cd3a92721b66733ca8bca66ab451eb5f5a31c907fdfca969c5872
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LOQTTS7.dll
          • Path C:\Program Files (x86)\Loquendo\LTTS7\bin\LOQTTS7.dll
          • Size 868KB
          • SHA256 7c94f072bdad7ea6cfea0018217f73c8e52c1942336b8bae5e4837cf6d726baa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LTTS7.ocx
          • Path C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7.ocx
          • Size 436KB
          • SHA256 66be83bda2425957f7887e1e95f8d82bbdf8a2cee6dc0b3513015b6da9cee3bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LTTS7SAPI4.dll
          • Path C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7SAPI4.dll
          • Size 232KB
          • SHA256 30a9f5a4a54333bd3735bbbc9bc370d3e02ed56ecbf070dc3932a8ca74089065
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LTTS7SAPI5.dll
          • Path C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7SAPI5.dll
          • Size 176KB
          • SHA256 998eb0e4e10c8bf0a2c133fee4caffddba035ae0137bdf5684a2bc1daed274b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LTTS7Util.dll
          • Path C:\Program Files (x86)\Loquendo\LTTS7\bin\LTTS7Util.dll
          • Size 260KB
          • SHA256 ae9d91f2c9020cb78a0bf6963023c1faf749842a9d4976c2eff4866e5ce9b068
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI590.tmp
          • Path C:\Windows\Installer\MSI590.tmp
          • Size 138KB
          • SHA256 4ef63003f3384975becb1568922f97d987cd496cc8846ffdc95f9588f44304fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 809ed943d197998d0798036d2355bd1c2259531faa6b1efb716348788b2d807f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {811c9e70-fca6-48ae-950e-82b59d8a131b}_OnDiskSnapshotProp
          • Path \??\Volume{ed77d9b0-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{811c9e70-fca6-48ae-950e-82b59d8a131b}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 e2db9dab21bd154b121b39158c16794e555a531ada458d12ec4855fe3c2803a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LTTS_7-EngineFull.log
          • Path \??\c:\LTTS_7-EngineFull.log
          • Size 86KB
          • SHA256 297843e0fdf6090bc18619f836732b86cc18893c96708051ae05f29173d295ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2528-88-0x0000000002940000-0x0000000002A1E000-memory.dmp
          Download

          memory/2528-91-0x0000000002A20000-0x0000000002A63000-memory.dmp
          Download

          memory/3872-62-0x00000000029E0000-0x0000000002A23000-memory.dmp
          Download

          memory/3872-58-0x0000000002900000-0x00000000029DE000-memory.dmp
          Download

          memory/4716-70-0x0000000002F00000-0x0000000002FDE000-memory.dmp
          Download

          memory/4716-73-0x0000000002FE0000-0x0000000003023000-memory.dmp
          Download

          memory/4892-51-0x00000000030D0000-0x0000000003113000-memory.dmp
          Download

          memory/4892-46-0x0000000002CA0000-0x0000000002D7E000-memory.dmp
          Download