Overview

overview

7

Static

static

3

R2R System v1.5.1.exe

windows10-2004-x64

7

R2R System v1.5.1.exe

windows11-ltsc_2024-x64

readme.txt

windows10-2004-x64

1

readme.txt

windows11-ltsc_2024-x64

1

TEAM R2R R...2R.txt

windows10-2004-x64

1

TEAM R2R R...2R.txt

windows11-ltsc_2024-x64

1

TEAM R2R R...CA.cer

windows10-2004-x64

1

TEAM R2R R...CA.cer

windows11-ltsc_2024-x64

1

TEAM R2R R...ST.exe

windows10-2004-x64

3

TEAM R2R R...ST.exe

windows11-ltsc_2024-x64

3

Resubmissions

23/08/2026, 19:43

260823-yfkj7svtb17

23/08/2026, 19:39

260823-yc2djsan317

Analysis

  • user interaction
    yes
  • max time kernel
    112s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 19:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    R2R System v1.5.1.exe
  • Size 24.9MB
  • Sample260823-yc2djsan31
  • SHA256 850d0e5838ca5398ba931f43b2eb819d1ed8aba850626be749af10cb54fc0cf6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 50 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.1.exe
    "C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Users\Admin\AppData\Local\Temp\is-ZXFT1EE6FE.tmp\R2R System v1.5.1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ZXFT1EE6FE.tmp\R2R System v1.5.1.tmp" /SL5="$40098,24484495,950272,C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.1.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Users\Admin\AppData\Local\Temp\is-MFHSW2TYWU.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-MFHSW2TYWU.tmp\VC_redist.x64.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Windows\Temp\{8B8F5060-68E9-4D55-81E9-6342F80F24CA}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{8B8F5060-68E9-4D55-81E9-6342F80F24CA}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-MFHSW2TYWU.tmp\VC_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5556
          • C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{28BF67AF-4E5A-41E1-87EB-FEFF9449CC00} {A49574DD-CAA3-42D4-B754-C75F19E733F1} 5556
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:4176
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3292
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4776
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:5644
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5420
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823204039.log" /install
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1048
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823204039.log" /install
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:944
            • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C756BD38-CADC-4500-A4EA-FFF4AE076DBE} {65D7B61D-A3CB-4F8C-8A12-851743524520} 944
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3264
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1004 -burn.embedded BurnPipe.{BF31883A-CF3F-4AC5-94CA-D3FFBE97A416} {69EB7AB4-EF1A-4573-9378-959A7CD330F9} 3264
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2888
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1004 -burn.embedded BurnPipe.{BF31883A-CF3F-4AC5-94CA-D3FFBE97A416} {69EB7AB4-EF1A-4573-9378-959A7CD330F9} 3264
                  6⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3456
                  • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                    "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{90FE0174-BDD6-4B30-BDF1-A839F9B52F79} {32A78271-DAE1-4A9B-A11C-67E42A44CCFC} 3456
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:2152
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3a2a855 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2712
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k CameraMonitor
        1⤵
          PID:4668

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e5a17c4.rbs
              • Path C:\Config.Msi\e5a17c4.rbs
              • Size 19KB
              • SHA256 05b7c827b7a970e996babdb47d5f7ba3604cc3711a89083c49d9053a3c6f5367
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a17d0.rbs
              • Path C:\Config.Msi\e5a17d0.rbs
              • Size 19KB
              • SHA256 19a6eb3ce9bcb85daba976e44b8a23ab88c0e21fb5fdf64a27b9353c4d25e0d8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a17d7.rbs
              • Path C:\Config.Msi\e5a17d7.rbs
              • Size 21KB
              • SHA256 12c49d03bbc78b0ea1ddad3e50ad038a74d12bab8ef5dc5a6a4736acddef7e82
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e5a17e6.rbs
              • Path C:\Config.Msi\e5a17e6.rbs
              • Size 21KB
              • SHA256 49dcdac6716bae5662c359d7bda940e98ecc6dc10533ad4022eddb2f838c72cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
              • Size 980B
              • SHA256 98f3059567bec7cc207845a9b20332922bae247ae8df006cd07663843c5fc5db
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
              • Size 960B
              • SHA256 15d4e6ac8ac43af973d47b38aa361d128f4f90a068b4d49d1923e288b31527d7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_amd64_20260823204039_000_vcRuntimeMinimum_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823204039_000_vcRuntimeMinimum_x64.log
              • Size 2KB
              • SHA256 bcbd7c9223654967a7e7bbeb52cbb7f1ee5bc9dd0af3ccb3b72e51699e05ca50
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_amd64_20260823204039_001_vcRuntimeAdditional_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260823204039_001_vcRuntimeAdditional_x64.log
              • Size 2KB
              • SHA256 9c7971eab575f71d3fc720b98d9dfebb5e3fefe2d8002f6632456ee1f6218fa8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-MFHSW2TYWU.tmp\VC_redist.x64.exe
              • Size 17.9MB
              • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              R2R System v1.5.1.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-ZXFT1EE6FE.tmp\R2R System v1.5.1.tmp
              • Size 4.9MB
              • SHA256 aec21619c8c4db0971ae81321ca5c3dc1227b3bf888909f5a40ac13165c1508c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Windows\Temp\{8B8F5060-68E9-4D55-81E9-6342F80F24CA}\.cr\VC_redist.x64.exe
              • Size 615KB
              • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\.ba\wixstdba.dll
              • Size 215KB
              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Path C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Size 5.4MB
              • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab5046A8AB272BF37297BB7928664C9503
              • Path C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\cab5046A8AB272BF37297BB7928664C9503
              • Size 1.0MB
              • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x64
              • Path C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\vcRuntimeAdditional_x64
              • Size 208KB
              • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x64
              • Path C:\Windows\Temp\{8C4F2029-BDA2-4701-AB53-B987F9DB34ED}\vcRuntimeMinimum_x64
              • Size 208KB
              • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{C66A3563-256B-4428-BF75-505C366D3C0F}\.ba\wixstdba.dll
              • Size 191KB
              • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2152-321-0x00000000005D0000-0x0000000000647000-memory.dmp
              Download

              memory/2888-324-0x00000000005D0000-0x0000000000647000-memory.dmp
              Download

              memory/3456-323-0x00000000005D0000-0x0000000000647000-memory.dmp
              Download

              memory/3484-8-0x0000000000660000-0x0000000000756000-memory.dmp
              Download

              memory/3484-0-0x0000000000660000-0x0000000000756000-memory.dmp
              Download

              memory/3484-345-0x0000000000660000-0x0000000000756000-memory.dmp
              Download

              memory/4872-9-0x0000000000A10000-0x0000000000F20000-memory.dmp
              Download

              memory/4872-10-0x0000000001A80000-0x0000000001A81000-memory.dmp
              Download

              memory/4872-142-0x0000000000A10000-0x0000000000F20000-memory.dmp
              Download

              memory/4872-6-0x0000000001A80000-0x0000000001A81000-memory.dmp
              Download

              memory/4872-335-0x0000000000A10000-0x0000000000F20000-memory.dmp
              Download

              memory/4872-344-0x0000000000A10000-0x0000000000F20000-memory.dmp
              Download