Overview

overview

6

Static

static

1

iPodSuppor...1).exe

windows10-2004-x64

6

iPodSuppor...1).exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/10/2026, 23:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    iPodSupport64Setup (1).exe
  • Size 32.3MB
  • Sample261013-3vaqrssx3m
  • SHA256 07bbe616b8efad8803d7b693c91eb0f54c3f134c43991cb40dc865394414d6cb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
persistenceprivilege_escalationransomware

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 24 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 24 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks SCSI registry key(s) 3 TTPs 37 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\iPodSupport64Setup (1).exe
    "C:\Users\Admin\AppData\Local\Temp\iPodSupport64Setup (1).exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5408
    • C:\Windows\system32\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IXP421.TMP\iPodSupport64.msi" INSTALL_SUPPORT_PACKAGES=1
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1632
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:6076
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2728
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 44A4CF159CBB985A4A7E91556A9BABF9
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:5068
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 652E21A57EB26571E524504FF5FE6BB7 E Global\MSI0000
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        PID:1952
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2160
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Program Files\iPod\Drivers\usbaapl64.inf" "9" "460d388b3" "0000000000000164" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\iPod\Drivers"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5940
    • C:\Program Files\iPod\bin\iPodService.exe
      "C:\Program Files\iPod\bin\iPodService.exe"
      1⤵
      • Executes dropped EXE
      PID:5472
    • C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
      "C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3256
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:1712
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
        1⤵
          PID:1244
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
          1⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          PID:3576
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
          1⤵
            PID:3012
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
            1⤵
            • Modifies data under HKEY_USERS
            PID:3452

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e59b85c.rbs
                • Path C:\Config.Msi\e59b85c.rbs
                • Size 715KB
                • SHA256 bc1f1da619ca971b2650a8b3a1d4c906f8d4a5f2c2db8d7d414d81b323d02c87
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                USBAAPL64.CAT
                • Path C:\PROGRA~1\iPod\Drivers\USBAAPL64.CAT
                • Size 14KB
                • SHA256 946b0a8150213d6a4dd3aef6248ebb923f8167c84c7ff1b10137e5030ec8bf30
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                usbaapl64.sys
                • Path C:\PROGRA~1\iPod\Drivers\usbaapl64.sys
                • Size 53KB
                • SHA256 4dec2fc20329f248135da24cb6694fd972dcce8b1bbea8d872fde41939e96aaf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                usbaaplrc.dll
                • Path C:\PROGRA~1\iPod\Drivers\usbaaplrc.dll
                • Size 5.8MB
                • SHA256 5ed0d8f2066dd19d5aec42c5498fdd1db9cefab4d024a1015c707dfd0cfd5b20
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                usbaapl64.inf
                • Path C:\Program Files\iPod\Drivers\usbaapl64.inf
                • Size 5KB
                • SHA256 edea577e694efceec5b26d745fff8125e9fc8a78cacd7365e77ef35031ebc49b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                iPodService.exe
                • Path C:\Program Files\iPod\bin\iPodService.exe
                • Size 657KB
                • SHA256 4e4f6f98db1cbe9754b7458bf2b843fdb62e45a33c3f8d42695980e32d407f58
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                iPodSupport64.msi
                • Path C:\Users\Admin\AppData\Local\Temp\IXP421.TMP\iPodSupport64.msi
                • Size 32.8MB
                • SHA256 e0ca9fd5f21eb77a7a9706c34dfbc135725c983cb3cfd94c1f6a1f62020f5410
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSIC0E5.tmp
                • Path C:\Windows\Installer\MSIC0E5.tmp
                • Size 152KB
                • SHA256 ecdf8f84dba8944a820f3727b8af3d2406fe389138421f003f0d35d607511c1b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSIC731.tmp
                • Path C:\Windows\Installer\MSIC731.tmp
                • Size 149KB
                • SHA256 ea5d4b4c7e7be1ce24a614ae1e31a58bcae6f1694dd8bfb735cf47d35a08d59b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSICA9D.tmp
                • Path C:\Windows\Installer\MSICA9D.tmp
                • Size 690KB
                • SHA256 cb42fac1aebb6e1ac4907a38035b218b5f992d1bcd4dece11b1664a588e876e4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dberr.txt
                • Path C:\Windows\System32\CatRoot2\dberr.txt
                • Size 70KB
                • SHA256 d3fc678b675f214708d283cae736f098e567b28fc90f8781f96763eaaf79da1f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                usbaapl64.inf_amd64_c0e4d8c2aef471b7.ini
                • Path C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7.ini
                • Size 411B
                • SHA256 9b9275c0873723fa15a0059eef7ea302ae8d8075fb55698dbe2a65d31663c19a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                usbaapl64.inf_amd64_c0e4d8c2aef471b7.ini
                • Path C:\Windows\System32\DriverStore\FileRepository\usbaapl64.inf_amd64_c0e4d8c2aef471b7.ini
                • Size 541B
                • SHA256 c2fffaa1fa75acc00dc150186e25ef5d3bb945aba374675cdef710232e7254ba
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                metadata-2
                • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                • Size 26.1MB
                • SHA256 25109e6a5dfb50db90ea69dc1ed9d153c0ccd0228fb8e549cf14d41f065d9675
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                {ec17be49-2e38-4aad-94cb-8f97f9b91205}_OnDiskSnapshotProp
                • Path \??\Volume{af02990b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{ec17be49-2e38-4aad-94cb-8f97f9b91205}_OnDiskSnapshotProp
                • Size 6KB
                • SHA256 1f82910a11736b179c71f0f740a9a65e3ba326c5fcefbf1d10674207c84962d4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download