Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 03:48
General
- Target 2026-08-08_3716e5d979efc5c10771722d108a0bde_elex_floxif_wannacry.exe
- Size 13.5MB
- Sample260808-ec33lasxfw
- SHA256 8c8e7823d422b3d9455ecebb0b82f9290cec8f2647ffe706fa616a4f0a88ae7b
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 7 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_3716e5d979efc5c10771722d108a0bde_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3716e5d979efc5c10771722d108a0bde_elex_floxif_wannacry.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_3716e5d979efc5c10771722d108a0bde_elex_floxif_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3716e5d979efc5c10771722d108a0bde_elex_floxif_wannacry.exe" -sfxwaitall:0 "PotPlayer64.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PotPlayer64.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PotPlayer64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
Korean.ini
FFmpegMininum64.dll
PotPlayer64.dll
PotPlayer64.exe
PotPlayer64.ini
Default.dsf
WindowFrame.dsf
ffcodec64.dll
memory/2544-83-0x00007FFB0BC40000-0x00007FFB0BC41000-memory.dmp
memory/2544-60-0x00007FFB0C460000-0x00007FFB0C461000-memory.dmp
memory/2544-86-0x00007FFB0ACE0000-0x00007FFB0ACE1000-memory.dmp
memory/2544-85-0x00007FFB0BC60000-0x00007FFB0BC61000-memory.dmp
memory/2544-84-0x00007FFB0BC50000-0x00007FFB0BC51000-memory.dmp
memory/2544-187-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2544-82-0x00007FFB0BC30000-0x00007FFB0BC31000-memory.dmp
memory/2544-81-0x00007FFB0ACD0000-0x00007FFB0ACD1000-memory.dmp
memory/2544-80-0x00007FFB0ACA0000-0x00007FFB0ACA1000-memory.dmp
memory/2544-79-0x00007FFB0BC20000-0x00007FFB0BC21000-memory.dmp
memory/2544-78-0x00007FFB0BC10000-0x00007FFB0BC11000-memory.dmp
memory/2544-77-0x00007FFB0BC00000-0x00007FFB0BC01000-memory.dmp
memory/2544-76-0x00007FFB0BBF0000-0x00007FFB0BBF1000-memory.dmp
memory/2544-75-0x00007FFB0AC90000-0x00007FFB0AC91000-memory.dmp
memory/2544-74-0x00007FFB0BBE0000-0x00007FFB0BBE1000-memory.dmp
memory/2544-73-0x00007FFB0AD30000-0x00007FFB0AD31000-memory.dmp
memory/2544-72-0x00007FFB0AD20000-0x00007FFB0AD21000-memory.dmp
memory/2544-71-0x00007FFB0BBD0000-0x00007FFB0BBD1000-memory.dmp
memory/2544-70-0x00007FFB0BBA0000-0x00007FFB0BBA1000-memory.dmp
memory/2544-69-0x00007FFB0AC80000-0x00007FFB0AC81000-memory.dmp
memory/2544-68-0x00007FFB0AC70000-0x00007FFB0AC71000-memory.dmp
memory/2544-67-0x00007FFB0BBC0000-0x00007FFB0BBC1000-memory.dmp
memory/2544-66-0x00007FFB0BBB0000-0x00007FFB0BBB1000-memory.dmp
memory/2544-65-0x00007FFB0AD40000-0x00007FFB0AD41000-memory.dmp
memory/2544-64-0x00007FFB0AC60000-0x00007FFB0AC61000-memory.dmp
memory/2544-63-0x00007FFB0C5C0000-0x00007FFB0C5C1000-memory.dmp
memory/2544-61-0x00007FFB0AC40000-0x00007FFB0AC41000-memory.dmp
memory/2544-87-0x00007FFB0ACF0000-0x00007FFB0ACF1000-memory.dmp
memory/2544-59-0x00007FFB0ACC0000-0x00007FFB0ACC1000-memory.dmp
memory/2544-58-0x00007FFB0ACB0000-0x00007FFB0ACB1000-memory.dmp
memory/2544-57-0x00007FFB0CAC0000-0x00007FFB0CAC1000-memory.dmp
memory/2544-56-0x00007FFB0CAB0000-0x00007FFB0CAB1000-memory.dmp
memory/2544-88-0x00007FFB0BC70000-0x00007FFB0BC71000-memory.dmp
memory/2544-89-0x00007FFB0BC80000-0x00007FFB0BC81000-memory.dmp
memory/2544-90-0x00007FFB0AD00000-0x00007FFB0AD01000-memory.dmp
memory/2544-91-0x00007FFB0AD10000-0x00007FFB0AD11000-memory.dmp
memory/2544-103-0x0000000000FA0000-0x0000000000FF0000-memory.dmp
memory/2544-182-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2544-157-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2544-111-0x0000000000FA0000-0x0000000000FF0000-memory.dmp
memory/2544-109-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2544-110-0x0000000063400000-0x0000000064E8F000-memory.dmp
memory/2544-62-0x00007FFB0AC50000-0x00007FFB0AC51000-memory.dmp
memory/2544-147-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2544-116-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2544-142-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2544-128-0x0000022A69FE0000-0x0000022A6B6D4000-memory.dmp
memory/2900-126-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2900-114-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2900-106-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2900-3-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5036-49-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5036-108-0x0000000010000000-0x0000000010030000-memory.dmp