Overview

overview

7

Static

static

3

R2R System v1.5.2.exe

windows10-2004-x64

7

R2R System v1.5.2.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    232s
  • max time network
    185s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 02:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    R2R System v1.5.2.exe
  • Size 24.9MB
  • Sample260910-dbjf5aw1gz
  • SHA256 f02e4c064f6e206e60917911be68c1a53a0b7411b87a80005c468db8becd0191
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 50 IoCs
  • Drops file in Windows directory 27 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.2.exe
    "C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5984
    • C:\Users\Admin\AppData\Local\Temp\is-C5L7DY4S1F.tmp\R2R System v1.5.2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-C5L7DY4S1F.tmp\R2R System v1.5.2.tmp" /SL5="$801E4,24483415,946688,C:\Users\Admin\AppData\Local\Temp\R2R System v1.5.2.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Users\Admin\AppData\Local\Temp\is-QFLK2DC8D7.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-QFLK2DC8D7.tmp\VC_redist.x64.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Windows\Temp\{E8770022-F9BA-4670-AF50-3A5B07C6634C}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{E8770022-F9BA-4670-AF50-3A5B07C6634C}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-QFLK2DC8D7.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /passive /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5172
          • C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{73F898FD-757B-4779-AD02-2231DEAE64DC} {A6DE3EAD-4F33-4AFD-B8A0-EF52FDDEB872} 5172
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1228 -burn.embedded BurnPipe.{4C50A3C6-2F8F-4954-87DD-202E6CF8BED6} {5E570C1C-4AA2-4579-9572-D17E367B079E} 1992
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6020
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1228 -burn.embedded BurnPipe.{4C50A3C6-2F8F-4954-87DD-202E6CF8BED6} {5E570C1C-4AA2-4579-9572-D17E367B079E} 1992
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1100
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{56AF691A-FEC0-444E-AF79-6776D9733544} {73CA19E8-90B7-41B7-9D19-5AB80F78543F} 1100
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:1404
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3656
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:5840
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1612
    • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910035032.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910035032.log" /install
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5712
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{EF038FAC-BE70-45FA-A1B5-ACEBE1DC13A4} {5D3432C7-4DD8-466B-B4CD-D8B6D33396B6} 5712
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:996

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a0a28.rbs
          • Path C:\Config.Msi\e5a0a28.rbs
          • Size 19KB
          • SHA256 47a064dfb8efbaf5e486d909ebb106625e6fbdcd91370afe16fd13ad69a2328d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a0a34.rbs
          • Path C:\Config.Msi\e5a0a34.rbs
          • Size 19KB
          • SHA256 d5685db5b0ae09a0415c7c754dec92cd680b387cf67e7ff7fcbb52c2a59198c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a0a3b.rbs
          • Path C:\Config.Msi\e5a0a3b.rbs
          • Size 21KB
          • SHA256 0859c36b192d80e25774243690fb6a131197e23162795dc33b1eddced02cddff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a0a4a.rbs
          • Path C:\Config.Msi\e5a0a4a.rbs
          • Size 21KB
          • SHA256 22d4660eee953113a3fe2dc8779a2557b8bb37aeef646b46daed08ebba6dada5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a0a4e.rbs
          • Path C:\Config.Msi\e5a0a4e.rbs
          • Size 3KB
          • SHA256 d710c7dcbb02340d2c9b2a95c6539bac237afdabcb2ae855b8247739439156c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          state.rsm
          • Path C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\state.rsm
          • Size 980B
          • SHA256 91b5278d084969924d02993136891de602570c7c7efe1c17170dfcbe78669f98
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSIa2d89.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSIa2d89.LOG
          • Size 2KB
          • SHA256 d070b47190762c1eb897f360420af978abe75f715b21c910ca1ec43e8b996f05
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260910035032_000_vcRuntimeMinimum_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910035032_000_vcRuntimeMinimum_x64.log
          • Size 2KB
          • SHA256 ebe7e6f1ad177092f0380a0b52b4743eec3bfb2f2958c056d314cd5c19e1d6ea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dd_vcredist_amd64_20260910035032_001_vcRuntimeAdditional_x64.log
          • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260910035032_001_vcRuntimeAdditional_x64.log
          • Size 2KB
          • SHA256 228e653b2d053107db35933cc51993f12a85fa0910a3cb5b02ef222529f106b3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          R2R System v1.5.2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-C5L7DY4S1F.tmp\R2R System v1.5.2.tmp
          • Size 4.9MB
          • SHA256 c969600609c6ba4dd9d17cd321d1bd8c6f3f4e7cdf69011487ce060deb608945
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-QFLK2DC8D7.tmp\VC_redist.x64.exe
          • Size 17.9MB
          • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Path C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
          • Size 5.4MB
          • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cab5046A8AB272BF37297BB7928664C9503
          • Path C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\cab5046A8AB272BF37297BB7928664C9503
          • Size 1.0MB
          • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeAdditional_x64
          • Path C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\vcRuntimeAdditional_x64
          • Size 208KB
          • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcRuntimeMinimum_x64
          • Path C:\Windows\Temp\{A6A2D8AF-FA76-4F5B-970E-836E931B0E66}\vcRuntimeMinimum_x64
          • Size 208KB
          • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Windows\Temp\{E8770022-F9BA-4670-AF50-3A5B07C6634C}\.cr\VC_redist.x64.exe
          • Size 615KB
          • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{FC9E06DB-4C47-4468-8D8A-19398805FC05}\.ba\wixstdba.dll
          • Size 191KB
          • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/868-348-0x00000000004F0000-0x0000000000A08000-memory.dmp
          Download

          memory/868-115-0x00000000004F0000-0x0000000000A08000-memory.dmp
          Download

          memory/868-116-0x0000000001910000-0x0000000001911000-memory.dmp
          Download

          memory/868-6-0x0000000001910000-0x0000000001911000-memory.dmp
          Download

          memory/868-349-0x00000000004F0000-0x0000000000A08000-memory.dmp
          Download

          memory/1100-340-0x0000000000FF0000-0x0000000001067000-memory.dmp
          Download

          memory/1404-337-0x0000000000FF0000-0x0000000001067000-memory.dmp
          Download

          memory/5984-0-0x0000000000ED0000-0x0000000000FC6000-memory.dmp
          Download

          memory/5984-350-0x0000000000ED0000-0x0000000000FC6000-memory.dmp
          Download

          memory/5984-114-0x0000000000ED0000-0x0000000000FC6000-memory.dmp
          Download

          memory/6020-341-0x0000000000FF0000-0x0000000001067000-memory.dmp
          Download