Overview

overview

7

Static

static

3

R2R System v1.5.2.exe

windows10-2004-x64

7

R2R System v1.5.2.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    102s
  • max time network
    107s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    R2R System v1.5.2.exe
  • Size 24.9MB
  • Sample260910-c7b69adl8s
  • SHA256 f02e4c064f6e206e60917911be68c1a53a0b7411b87a80005c468db8becd0191
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 50 IoCs
  • Drops file in Windows directory 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.2.exe
    "C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\is-2HWACJH55Y.tmp\R2R System v1.5.2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2HWACJH55Y.tmp\R2R System v1.5.2.tmp" /SL5="$400C4,24483415,946688,C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.2.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5064
      • C:\Users\Admin\AppData\Local\Temp\is-GUUJMOK4XH.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GUUJMOK4XH.tmp\VC_redist.x64.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:260
        • C:\Windows\Temp\{4B0C547F-4776-4F75-9C67-33CE399DC56B}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{4B0C547F-4776-4F75-9C67-33CE399DC56B}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-GUUJMOK4XH.tmp\VC_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756 /install /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A498F8C4-F286-4575-83C1-F5AF62A9061B} {0FAFCE16-E3CC-4E5A-8B80-53FA11F7080A} 4160
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:1916
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3012
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:4188
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4764
    • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910034304.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4944
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=564 -burn.filehandle.self=584 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910034304.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{DA33D7AE-7E75-450B-A843-C67F68CA337D} {0C2670FF-7717-4043-8CB8-CE55FB73C130} 2996
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3388
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{2F6FDBFC-C77D-4FA5-9329-6617997C96E5} {5BC2D624-4FCA-4EDE-B360-F71BCF26BDB0} 3388
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5924
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1020 -burn.embedded BurnPipe.{2F6FDBFC-C77D-4FA5-9329-6617997C96E5} {5BC2D624-4FCA-4EDE-B360-F71BCF26BDB0} 3388
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1924
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A6B850F9-7133-49A2-91FD-5B57335C8D40} {9EDDCEA5-6E5D-4AD8-880C-F24D403BC8F6} 1924
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:5228
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3a33055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:5188
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:5404
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k CameraMonitor
        1⤵
          PID:1420

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59dbe4.rbs
              • Path C:\Config.Msi\e59dbe4.rbs
              • Size 19KB
              • SHA256 12c285cf1e74785317fdd3b8528d39b8646e2c1b9e19a4632e2a0d9e3de4c435
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59dbf0.rbs
              • Path C:\Config.Msi\e59dbf0.rbs
              • Size 19KB
              • SHA256 4269a50a5db80625e64ddb8eb22067518c9028dd60464aa9c8e5fe465615b442
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59dbf7.rbs
              • Path C:\Config.Msi\e59dbf7.rbs
              • Size 21KB
              • SHA256 be2b6e94ddefbfb744b4410526d573b7e576d6d0942285e8875813dc72996f65
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59dc06.rbs
              • Path C:\Config.Msi\e59dc06.rbs
              • Size 21KB
              • SHA256 fd4b2fb1080f3d71a286b19c94f3b66ca2979c6391fbf6266c96380ddefd3ead
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              state.rsm
              • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
              • Size 980B
              • SHA256 9d7d9e9fc0af13ab2de090e9451c85833fd3eac3c19fe292437e860505709525
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_amd64_20260910034304_000_vcRuntimeMinimum_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910034304_000_vcRuntimeMinimum_x64.log
              • Size 2KB
              • SHA256 fe3f5f2e319bd8536c10d0c3f25330666e690f75cad311a1b2744c9c66969d2f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dd_vcredist_amd64_20260910034304_001_vcRuntimeAdditional_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910034304_001_vcRuntimeAdditional_x64.log
              • Size 2KB
              • SHA256 5c24ea6b423647a5c0d8bbe99eccbb62e8173b4b6e45e9bf6bcc36a5cc6a5c05
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              R2R System v1.5.2.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-2HWACJH55Y.tmp\R2R System v1.5.2.tmp
              • Size 4.9MB
              • SHA256 c969600609c6ba4dd9d17cd321d1bd8c6f3f4e7cdf69011487ce060deb608945
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-GUUJMOK4XH.tmp\VC_redist.x64.exe
              • Size 17.9MB
              • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{1DF60E54-4EB1-45A3-AC24-07327C922C0F}\.ba\wixstdba.dll
              • Size 191KB
              • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\.ba\wixstdba.dll
              • Size 215KB
              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Path C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Size 5.4MB
              • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab5046A8AB272BF37297BB7928664C9503
              • Path C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\cab5046A8AB272BF37297BB7928664C9503
              • Size 1.0MB
              • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x64
              • Path C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\vcRuntimeAdditional_x64
              • Size 208KB
              • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x64
              • Path C:\Windows\Temp\{2A5E7212-D20E-41CC-811A-DC967F4949BC}\vcRuntimeMinimum_x64
              • Size 208KB
              • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Windows\Temp\{4B0C547F-4776-4F75-9C67-33CE399DC56B}\.cr\VC_redist.x64.exe
              • Size 615KB
              • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1924-322-0x0000000000310000-0x0000000000387000-memory.dmp
              Download

              memory/4836-119-0x0000000000020000-0x0000000000116000-memory.dmp
              Download

              memory/4836-0-0x0000000000020000-0x0000000000116000-memory.dmp
              Download

              memory/4836-339-0x0000000000020000-0x0000000000116000-memory.dmp
              Download

              memory/5064-121-0x0000000002B90000-0x0000000002B91000-memory.dmp
              Download

              memory/5064-6-0x0000000002B90000-0x0000000002B91000-memory.dmp
              Download

              memory/5064-120-0x0000000000340000-0x0000000000858000-memory.dmp
              Download

              memory/5064-332-0x0000000000340000-0x0000000000858000-memory.dmp
              Download

              memory/5064-338-0x0000000000340000-0x0000000000858000-memory.dmp
              Download

              memory/5228-320-0x0000000000310000-0x0000000000387000-memory.dmp
              Download

              memory/5924-323-0x0000000000310000-0x0000000000387000-memory.dmp
              Download