Overview

overview

7

Static

static

3

R2R System v1.5.1.exe

windows10-2004-x64

R2R System v1.5.1.exe

windows11-ltsc_2024-x64

7

Resubmissions

10/08/2026, 01:47

260810-b7z3msyeqe7

10/08/2026, 01:40

260810-b33mzasxfw7

10/08/2026, 01:37

260810-b1wrmssxcs7

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 01:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    R2R System v1.5.1.exe
  • Size 24.9MB
  • Sample260810-b1wrmssxcs
  • SHA256 850d0e5838ca5398ba931f43b2eb819d1ed8aba850626be749af10cb54fc0cf6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerransomware

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 22 IoCs
  • Drops file in Program Files directory 50 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.1.exe
    "C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Users\Admin\AppData\Local\Temp\is-K1E054XOQD.tmp\R2R System v1.5.1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-K1E054XOQD.tmp\R2R System v1.5.1.tmp" /SL5="$400B2,24484495,950272,C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.1.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Users\Admin\AppData\Local\Temp\is-HNMTGZTLFX.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-HNMTGZTLFX.tmp\VC_redist.x64.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5512
        • C:\Windows\Temp\{1DB52244-9400-4131-83DF-36610737D578}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{1DB52244-9400-4131-83DF-36610737D578}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-HNMTGZTLFX.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Windows\Temp\{162652D1-64A1-4535-A7B4-1D7BDEDCBE06}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{162652D1-64A1-4535-A7B4-1D7BDEDCBE06}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{93CEFA52-DB8B-4775-88D0-DD85E9D9066A} {C71A2D9B-F0E7-4804-B9CC-A4B6A763A5EF} 4912
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2268
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\TEAM R2R\R2R System\Documents\manual.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3660
      • C:\Program Files\TEAM R2R\R2R System\WitchConfig.exe
        "C:\Program Files\TEAM R2R\R2R System\WitchConfig.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4696
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4848
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:5964
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4976
    • C:\Program Files\TEAM R2R\R2R System\WitchConfig.exe
      "C:\Program Files\TEAM R2R\R2R System\WitchConfig.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5832

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\R2RCRYPP\plugin.ini
          • Size 32B
          • SHA256 f47529cc2a7e30156b0c0202fc0b2e9ade559888a89feea1cccbd609f3451baf
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\R2REZKG\plugin.ini
          • Size 84B
          • SHA256 a7fa378a2cb41f15d6fced6d72b98ed947bee8d197df37774fe57c610b9898d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\R2RJUCE2\plugin.ini
          • Size 32B
          • SHA256 1f5a86ca2f0057ebae4f72eceacdf1887478a2bfdb2d307ddbc3b1e0f3f44421
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\bass\plugin.ini
          • Size 28B
          • SHA256 a41aa0603c065adb94c7737c31fd40de456dce867ed7f41ab7e8240362652bec
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\cbor\plugin.ini
          • Size 28B
          • SHA256 c70870626734df1cbdae8ee03c6e917a71393c87db5cd0c4508d6a60609f0092
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\ed25519\plugin.ini
          • Size 34B
          • SHA256 28ea9fdae38279d2827d8e9fe7042d155881494f8d58f3f06e341f4628ed8e67
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\libcrypto-3\plugin.ini
          • Size 39B
          • SHA256 9333c0e2dd9954e6cd894da31797269ddd9706fbdbbda55b94b20e4eb99b5a10
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\libcrypto-4\plugin.ini
          • Size 39B
          • SHA256 cf1b8fca9e8d34c9b8e45e210d1b47b8defea27c9784db839a096e5407034105
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\libeay32\plugin.ini
          • Size 32B
          • SHA256 6db1d2ce9ea80c4a8a6ee4af7be9b7fda6a283937788718942ca80b688abc7a2
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\libsodium\plugin.ini
          • Size 33B
          • SHA256 a99509db5eae2fdfffacca4cd0da9e12489b787b764af90fb206a5b22b231e96
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\nanojsonc\plugin.ini
          • Size 33B
          • SHA256 354b98858aee5e674832aa5a8adc83291192cdf77627e6a7a5b00bd99eb2752b
          • MD5 SHA1 SHA512
          Submit Download

          plugin.ini
          • Path C:\Program Files\Common Files\TEAM R2R\R2R System\Plugins\zlib\plugin.ini
          • Size 32B
          • SHA256 c898a2ed62edc2dcc91a88be522b2f02f8d0492afbd9672460b3cdd0841ab883
          • MD5 SHA1 SHA512
          Submit Download

          manual.txt
          • Path C:\Program Files\TEAM R2R\R2R System\Documents\manual.txt
          • Size 4KB
          • SHA256 429bd9b982ff5df5aa7b78e0a53e24b4d46eecc54cf1f4996d2dd8eb2195b460
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WitchConfig.exe
          • Path C:\Program Files\TEAM R2R\R2R System\WitchConfig.exe
          • Size 81KB
          • SHA256 9236c29ed0fddd6082452a6d6628bba7eae556ea01ce45ae6d46f13c024743d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-HNMTGZTLFX.tmp\VC_redist.x64.exe
          • Size 17.9MB
          • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          R2R System v1.5.1.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-K1E054XOQD.tmp\R2R System v1.5.1.tmp
          • Size 4.9MB
          • SHA256 aec21619c8c4db0971ae81321ca5c3dc1227b3bf888909f5a40ac13165c1508c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          R2RSYS.dll
          • Path C:\Windows\System32\R2RSYS.dll
          • Size 16KB
          • SHA256 3716c4bdbe394a2afb1a20431b58e10ed164157908abe44890e5940fe2a837a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{162652D1-64A1-4535-A7B4-1D7BDEDCBE06}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{162652D1-64A1-4535-A7B4-1D7BDEDCBE06}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Windows\Temp\{1DB52244-9400-4131-83DF-36610737D578}\.cr\VC_redist.x64.exe
          • Size 615KB
          • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3004-1-0x00000000009A0000-0x0000000000A96000-memory.dmp
          Download

          memory/3004-8-0x00000000009A0000-0x0000000000A96000-memory.dmp
          Download

          memory/5092-144-0x0000000000A60000-0x0000000000F70000-memory.dmp
          Download

          memory/5092-167-0x0000000000A60000-0x0000000000F70000-memory.dmp
          Download

          memory/5092-12-0x0000000000A60000-0x0000000000F70000-memory.dmp
          Download

          memory/5092-9-0x0000000000A60000-0x0000000000F70000-memory.dmp
          Download

          memory/5092-10-0x00000000033C0000-0x00000000033C1000-memory.dmp
          Download

          memory/5092-165-0x0000000000A60000-0x0000000000F70000-memory.dmp
          Download

          memory/5092-6-0x00000000033C0000-0x00000000033C1000-memory.dmp
          Download

          memory/5092-179-0x0000000000A60000-0x0000000000F70000-memory.dmp
          Download