Analysis date (UTC): 6 January 2025, 10:44Analysis environment: Windows 10 Pro, build 19045, x64

Lynx Ransomware

MD5:D972BBBB3EDB0E5AB5751B911F3DDA17

SHA1:C632223F5F7A8A469BBF07EB017863BB83564B84

SHA256:571F5DE9DD0D509ED7E5242B9B7473C2B2CBB36BA64D38B32122A0A337D6CF8B

Analysis result

Threat level:Malicious activity

Tags:

lynxransomware

Full analysis:Analysis Lynx Ransomware (MD5: D972BBBB3EDB0E5AB5751B911F3DDA17) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

LYNX has been detected

Lynx Ransomware.exe (PID: 5712)

Renames files like ransomware

Lynx Ransomware.exe (PID: 5712)

Scans artifacts that could help determine the target

ONENOTE.EXE (PID: 6244)

SUSPICIOUS

Executes as Windows Service

FXSSVC.exe (PID: 6176)

Reads security settings of Internet Explorer

ONENOTE.EXE (PID: 6244)

INFO

Checks supported languages

Lynx Ransomware.exe (PID: 5712)
ONENOTE.EXE (PID: 6244)

Creates files in the program directory

Lynx Ransomware.exe (PID: 5712)
FXSSVC.exe (PID: 6176)

Reads the machine GUID from the registry

Lynx Ransomware.exe (PID: 5712)

Reads the computer name

ONENOTE.EXE (PID: 6244)

Reads Microsoft Office registry keys

ONENOTE.EXE (PID: 6244)

Checks proxy server information

ONENOTE.EXE (PID: 6244)

Reads product name

ONENOTE.EXE (PID: 6244)

Reads Environment values

ONENOTE.EXE (PID: 6244)

Reads the software policy settings

ONENOTE.EXE (PID: 6244)

Creates files or folders in the user directory

ONENOTE.EXE (PID: 6244)

Sends debugging messages

ONENOTE.EXE (PID: 6244)

Process checks computer location settings

ONENOTE.EXE (PID: 6244)

Reads CPU info

ONENOTE.EXE (PID: 6244)

Threats

No threats detected