Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 16:08
General
- Target 2026-07-12_c5fcba0bd19c29e6009d826183734d42_elex_floxif_wannacry.exe
- Size 23.1MB
- Sample260712-tlehxscy6q
- SHA256 630d4c10acf1729a50c9f2ea67e88fe0a72a9db0dc0f22442ed2d5d8043bd087
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
- UPX dump on OEP (original entry point) 10 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 22 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_c5fcba0bd19c29e6009d826183734d42_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_c5fcba0bd19c29e6009d826183734d42_elex_floxif_wannacry.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_c5fcba0bd19c29e6009d826183734d42_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_c5fcba0bd19c29e6009d826183734d42_elex_floxif_wannacry.exe" -sfxwaitall:0 "QOwnNotesPortable.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\QOwnNotesPortable.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\QOwnNotesPortable.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\QOwnNotes\QOwnNotes.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\App\QOwnNotes\QOwnNotes.exe" --portable4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
QOwnNotesPortable.ini
appinfo.ini
QOwnNotes.ini
QOwnNotes.exe
QOwnNotes_en.qm
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5PrintSupport.dll
Qt5Qml.dll
Qt5Sql.dll
Qt5WebSockets.dll
Qt5Widgets.dll
Qt5Xml.dll
libgcc_s_seh-1.dll
libstdc++-6.dll
libwinpthread-1.dll
qwindows.dll
qwindowsvistastyle.dll
qt_en.qm
QOwnNotesPortableSettings.ini
QOwnNotesPortable.exe
QOwnNotesPortable.exe.tmp
System.dll
memory/724-342-0x0000000010000000-0x0000000010030000-memory.dmp
memory/724-356-0x00000000735A4000-0x00000000735A5000-memory.dmp
memory/724-398-0x0000000010000000-0x0000000010030000-memory.dmp
memory/724-416-0x00000000735A4000-0x00000000735A5000-memory.dmp
memory/1784-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1784-389-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1784-414-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1784-444-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1784-417-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2072-338-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2072-397-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4876-403-0x0000000064940000-0x0000000064955000-memory.dmp
memory/4876-526-0x0000000061940000-0x0000000062012000-memory.dmp
memory/4876-413-0x000000006CC40000-0x000000006CC75000-memory.dmp
memory/4876-411-0x00000000014C0000-0x0000000001A45000-memory.dmp
memory/4876-410-0x00000000660C0000-0x00000000664C2000-memory.dmp
memory/4876-409-0x0000000066C00000-0x0000000066C40000-memory.dmp
memory/4876-408-0x000000006EF80000-0x000000006EFB4000-memory.dmp
memory/4876-407-0x000000006D7C0000-0x000000006D80A000-memory.dmp
memory/4876-399-0x0000000000400000-0x0000000000B53000-memory.dmp
memory/4876-406-0x000000006DF40000-0x000000006DF9C000-memory.dmp
memory/4876-401-0x000000006FC40000-0x000000006FDA3000-memory.dmp
memory/4876-405-0x0000000061940000-0x0000000062012000-memory.dmp
memory/4876-412-0x000000006A880000-0x000000006AA45000-memory.dmp
memory/4876-404-0x0000000069700000-0x00000000698B2000-memory.dmp
memory/4876-386-0x0000000061940000-0x0000000062012000-memory.dmp
memory/4876-424-0x0000000068880000-0x0000000068EB9000-memory.dmp
memory/4876-433-0x00000000014C0000-0x0000000001A45000-memory.dmp
memory/4876-427-0x0000000061940000-0x0000000062012000-memory.dmp
memory/4876-402-0x0000000068880000-0x0000000068EB9000-memory.dmp
memory/4876-387-0x000000006DF40000-0x000000006DF9C000-memory.dmp
memory/4876-385-0x00000000014C0000-0x0000000001A45000-memory.dmp
memory/4876-471-0x0000000061940000-0x0000000062012000-memory.dmp
memory/4876-400-0x0000000061440000-0x000000006145A000-memory.dmp
memory/4876-523-0x0000000068880000-0x0000000068EB9000-memory.dmp
memory/4876-541-0x0000000068880000-0x0000000068EB9000-memory.dmp
memory/4876-544-0x0000000061940000-0x0000000062012000-memory.dmp