floxif | 818290ab1c59d4d57ab178d384be2f40cc5ab9a9352d00df1d5f660f27c41545

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe
Size 686KB
Sample260802-m32w8a1epg
SHA256 818290ab1c59d4d57ab178d384be2f40cc5ab9a9352d00df1d5f660f27c41545
MD5 aee474682c7b2937b1fb22192d45ced4
SHA1 115d802870da302c8a0279a3dd18f292d3b9e3b9
SHA512 5653f117a10718961b37f1fbc24ce61a2b0655296cf181c603e5e8e4c95c3b152d2afa156260fd55ac99043c3aac5c9cc868c9c6a087b6121d0c8ffe76037b0f
SSDEEP 12288:+zZLwrTdcz4fGp6OfBofQ1iX/math/rgYdB4mklf3Ys6Mcw9LXTAEhX7VUNTLiVN:OZLq6efh+AlBShf3R6E97TAE5ZoTL2rB
TLSH
T14AE4121271E483FEE5701A30B6887F61D2F1DA3E051A801FEB1109095F7E992DF7E66A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery floxif spyware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0007000000016b61-1.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x0007000000016b61-1.dat	UPX
behavioral2/memory/3200-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3200-71-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Manipulates Digital Signatures 1 TTPs 4 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 03000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa802000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 03000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa82000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa82000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000016b61-1.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
5848	dpscat.exe
3228	dpinst64.exe

Loads dropped DLL 1 IoCs

pid	Process
3200	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000016b61-1.dat	upx
behavioral2/memory/3200-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3200-71-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DPINST.LOG	dpinst64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 5 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 03000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa82000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa82000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 03000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa802000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 0f0000000100000014000000a26ea8f139d17bcfb7efad2c3a160834deeea6400b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e0065007200000000000000000003000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa82000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dpscat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 03000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa82000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa82000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8	dpscat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8	dpscat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\59C42E91F849AA97A842549F1979E374DE8ECAA8\Blob = 03000000010000001400000059c42e91f849aa97a842549f1979e374de8ecaa802000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a003020102021042cb244a403473ac4e64c6ad911ba6f1300d06092a864886f70d0101050500305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d301e170d3236303830323131303031395a170d3239303130313030303030305a305d315b305906035504031e52006c00690062007500730062002d00770069006e00330032002000280057006f0072006c0064004300750070005f004400650076006900630065002e0069006e006600290020005b00530065006c0066005d30819f300d06092a864886f70d010101050003818d0030818902818100ac72bfbefacad8cb27676cd150117bf7c84959e48ab07b538149ca7a129f4542d02bf150259d322b7bce722c7fad6ae4f2fbf5b09d2eef3a1f617467d133cc568b81e8eaa2faa6dd92b627f8e1cacb1181fbd0d8fafb54188be09acfad4ddaa6329a61c5373acf69a3fadc2a9ceeda874fe03a364fea3109f52a51112ad202950203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100644d01e3d454cb154452d77f48fa7bc181b300a9a7bdf9946494a5404d729a14dab657e5038d2d8dbf00b0204e3876808008981125ae02fc75f8ca6149e184fc909e7a98219cef3cec7af719142001657d8595e134489a98de090534da2aa223135404352a640101d166eca13b671a982cc1f746858eb373399e368a2a60706e	dpscat.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3200	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe
3200	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 5848	3200	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe	89
PID 3200 wrote to memory of 3228	3200	2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_aee474682c7b2937b1fb22192d45ced4_elex_floxif_wannacry.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe"
  2⤵
  - Manipulates Digital Signatures
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:5848
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WorldCup_Device.cat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\WorldCup_Device.cat
Size 4KB
SHA256 97536d6b20dc6c15c8a66aa240ba7e5be3c9e9e8e764899591533da7f583f031
MD5 d99940b58373fb2427675ed98ea96a26
SHA1 26a7dc8df461369f96220e75c9e239d2857d1a0b
SHA512 fa51139f5982cf2bcfbb9eb5e6ac004451430bed3ce5268977b78e837ed16261cf6d1c0f13dc10420dc96ad23b6fd66333a3960d27e26f86f169409648057d2b
SSDEEP 96:XfImXfmdmZmD1h2mAECYHnMeNMeNfs4fweNtpy:b+UI7pAECwn04fxpy
TLSH
T13B81137956DE0253E1A7C8728EE5706FF532EA97F804497E30A733110642752B75D82D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WorldCup_Device.inf

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\WorldCup_Device.inf
Size 7KB
SHA256 7f8f41819c3f4185f1d0510edc1d130abd4d1b34701240a5a42f21794c7b3b03
MD5 89d7cbf94872947c99d1880ee7a7bccd
SHA1 607e81836f3e58edc7289f7b7047149ae2c7f301
SHA512 57c0078288488024c13fe379f53555466ae04dda5d8a68aa52431658c9fc499d0a51027f277ace5235b8024992cb4d3a8f51bbb13289a9c5ecce0673a579b649
SSDEEP 96:hboapKfEHRMchXA9+G7jSBKrbvZkcwHiZBVChB:HpKfEHqcxA9p7jSBqacSU8hB
TLSH
T14AF19502A2D92218F1F36D40BEB151F9DA1378D6B93D9E5D20E4550A2AEEE40CD72FD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb0.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusb0.dll
Size 74KB
SHA256 4f18b5d2c28aa66b648c8683c6d09b52b92cbbee85984bbefad5f38a64bc2a14
MD5 1d8215f7f8cd02a553499b534ccfb4d5
SHA1 bab236f840f1521c43bcbaa2a7b92f14f329bc70
SHA512 79ef4b25f16b2f2f37605298470ba9c4600e724e4b52d589add7d48816f656b93c082b5c65669e50e0546865063a068d26390e6ec7fbab66c3726e49a3779d69
SSDEEP 1536:4Z4LV/bEtayHescyznkmrCvsgAM0vtPJZ9ivaaC+ziia3:4ZCxbEtayHpnkOBMmtPJzivaIO
TLSH
T166737C5797A5106ED5BBC03ACAE24127E6F1F400433856CF47A18A588E47BE69A3FF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb0.sys

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusb0.sys
Size 51KB
SHA256 8058f2afe6ef96a7d2ded432997fd8655970c9ea75a938ee4557d6a2cb4cc989
MD5 16e18ced459b1824234890386ee66cd5
SHA1 81d2b572ec0d24aba11ed6bfa9174ffad54140b7
SHA512 b0e67d040d39f043305b0c172906bbea8341f1326108f5c5a0379cd6b287d62cbd86270385713d0f6a14c5106a5a6c23f6247a303e6124cb3e33982978505c98
SSDEEP 768:HFXl2LF1UHgnnhe8178WtnYhD+icqO3cp3RtR7QnC+ziX7BE:yConbt8wifuQRtR7QnC+zirBE
TLSH
T1A6338D4AD75B444ECC93CA35EAA54623CFF0F8C447A44ADF0750846AAF03BE4A63DB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusbk.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\amd64\libusbk.dll
Size 96KB
SHA256 15a476d769a3d67668475284fc35ee6eb840ad332cef800ba8e3bfb35450e17a
MD5 e9e5aaf77a56fa64c700e6f6776c9702
SHA1 664f2c113d0e45b68153d55c99b3c326da609d4a
SHA512 81ba6bbd086832a735eb8cb5e3fa5221a7c1abfb0cee15042e828f044e3d474fb60bdf38e4ec7f3f44a65dcc15a5faa8c457c82788320dae8d35f88f8294e887
SSDEEP 1536:ql1AnAqMcBL7ILeqmDvqHQFEW3B9jh8Kxp1apazAeM+p2C+zipQVj:qmfpq63EQjhz3rAeMEEPj
TLSH
T1E7A36D5AF26810E2D56BD079DA928AD7EBF070810B6553CF13206B5A2F17BE06E3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpinst.xml

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst.xml
Size 661B
SHA256 127b6d24415b513c1f3b5ffe63af1b395dbf868dafec44c4cbb367d81db9ae0c
MD5 83f46ef4f06d32f8b3201a2ea2189e19
SHA1 d1aca0fd1646bf0abf5ffb42b0ca27345c7155ae
SHA512 7b48181bc0d183416294c6277ce4205355868cc7be705dfb24d0baf70865173fde578222f6e1c8ffd9bea4ef58d6f4375b7e3eac9236f64bd7ae0fc0c55a84a0
TLSH
T1EA017BEC4A2B26AFBF31950C421FE04159092B591D3BC68831C59527260329B54B17E7
MD5 SHA1 SHA512 TLSH

Submit Download

dpinst64.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpinst64.exe
Size 1.0MB
SHA256 181bf85d3b5900ff8abed34bc415afc37fc322d9d7702e14d144f96a908f5cab
MD5 be3c79033fa8302002d9d3a6752f2263
SHA1 a01147731f2e500282eca5ece149bcc5423b59d6
SHA512 77097f220cc6d22112b314d3e42b6eedb9ccd72beb655b34656326c2c63fb9209977ddac20e9c53c4ec7ccc8ea6910f400f050f4b0cb98c9f42f89617965aaea
SSDEEP 12288:uIId79EaUTvwieMozMEcOigSpuPMaLium:xIdqaWw1MsbTScP0
TLSH
T1FE258104E7FA4225F9F3AB7DA9B152528A32BC815B34CA8F4240569D1DF3AD0D971B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dpscat.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\dpscat.exe
Size 36KB
SHA256 7619b1e57ba38fb43adf3b975b5b838ae64bb3896ba94d774e8bbfeb9fe63dce
MD5 f5b7c11020fc963662745991f0292c71
SHA1 9011be99825e9b8a9c999760acd37dc44860ff5c
SHA512 c0133d25fdf9782a2ea70bd7606eebe2f7f108cb5b5b3b842508882b76580a506d06d04f860c057038b10a0aeadfcaad7fa46ffe7554f76755904a05c431ac60
SSDEEP 768:c/KwQwA/e4BFPfLRdM1bl2kZ6Z88VC+zi/jj:c/iwA/e4BFPf0bqXVC+zi/jj
TLSH
T1F9F2394257E4852AF0F31E3465B96A120E34BE718E75D3CF9281C9AE28B57E0DE74723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusb0_x86.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\x86\libusb0_x86.dll
Size 66KB
SHA256 00caca07869b19d10b370552ac7cc2f6f2ee246fc15db11650f6cd3f4ef9b666
MD5 535779909a40b42f4f3e48598f5778a5
SHA1 3a238468009a6dea3e4f70821339185e56ea3b69
SHA512 723b42c3df960f031343b9bb74a55ab874cd1f740a187a58bfecdad78876dd227392f18f6faea33e743593511a12635ef6419bb68d4361c6631584ebc8838e80
SSDEEP 1536:oy92wLYdq5fSmFBkg9uiMNoRP/RzojE5h5IlmkOC+ziUqT:ozwLjtSIi8MNoIjCh5IlmBM
TLSH
T103635C9BEA80A432D8D340B9519DB2329DFD9AB40758F8C7D75146D0E8A93D2F93930F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libusbk_x86.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx_000\x86\libusbk_x86.dll
Size 81KB
SHA256 a90e3d6961d1c8afb5bd6d73a5719177a3565215b7ec9b4c535a5f1347853fe9
MD5 1bd4a96d2d682a8c0bb92b8c5491b876
SHA1 2640af6fbc4b5ddcc24b8a2feee22473c7909974
SHA512 49308de825dbb27bceb50d48d8b7846a5fa9d59a1320ac1a4904191b4fed5a47b1a0fab1957228c9c95446d3c56febba8909001dbfa6a2cb916353068d57b33c
SSDEEP 1536:sGgkR+dWgaCTrXR43TntMJ6/Z2YUbqeapazAeWBWlC+zijk8:sGga0vRQTn4VYKXAeWBW78
TLSH
T115834B117750A7AEE8D630F4626CB377286CD0A2AFD826CF57271FE499743D06B7420A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3200-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3200-71-0x0000000010000000-0x0000000010030000-memory.dmp

Download