Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 00:21
General
- Target 2026-08-08_d2efa7f4213b13b56d661d51759e61e9_akira_elex_glassworm.exe
- Size 1.2MB
- Sample260808-anbehael7s
- SHA256 1a0158a718043a8f2ca30e7d2feae856b0d841f089fb9935af0c8ac473e86ced
Malware Config
Extracted
-
C:\ProgramData\Adobe\README.txt
-
lynx
- Your data is stolen and encrypted. Download TOR Browser to contact with us. ID ~ 675fd0e4e42beed9ed89e0fd Chat site: ~ TOR Network: http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login ~ TOR Mirror #1: http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login ~ TOR Mirror #2: http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login ~ TOR Mirror #3: http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login ~ TOR Mirror #4: http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login ~ TOR Mirror #5: http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login ~ TOR Mirror #6: http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login ~ Mirror #7: http://lynxchat.net/login Our blog: ~ TOR Network: http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/ ~ TOR Mirror #1: http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/ ~ TOR Mirror #2: http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/ ~ TOR Mirror #3: http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/ ~ TOR Mirror #4: http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/ ~ TOR Mirror #5: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/ ~ TOR Mirror #6: http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/ ~ Mirror #7: http://lynxblog.net/
-
http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login
-
http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login
-
http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login
-
http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login
-
http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login
-
http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login
-
http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login
-
http://lynxchat.net/login
-
http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/
-
http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/
-
http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/
-
http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/
-
http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/
-
http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/
-
http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/
-
http://lynxblog.net/
Signatures
- Family: Lynx
Lynx is a Windows ransomware which operates using a ransomware-as-a-service model.
- Detects Lynx Ransomware 30 IoCs
- Renames multiple (295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_d2efa7f4213b13b56d661d51759e61e9_akira_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d2efa7f4213b13b56d661d51759e61e9_akira_elex_glassworm.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{9FA3947E-F8C2-40DF-9159-79FAFB7150CC}.xps" 1343062208242400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
README.txt
Open Notebook.onetoc2
memory/2148-1719-0x00007FFC26E00000-0x00007FFC26E10000-memory.dmp
memory/2148-1725-0x00007FFC240D0000-0x00007FFC240E0000-memory.dmp
memory/2148-1724-0x00007FFC240D0000-0x00007FFC240E0000-memory.dmp
memory/2148-1720-0x00007FFC26E00000-0x00007FFC26E10000-memory.dmp
memory/2148-1721-0x00007FFC26E00000-0x00007FFC26E10000-memory.dmp
memory/2148-1723-0x00007FFC26E00000-0x00007FFC26E10000-memory.dmp
memory/2148-1722-0x00007FFC26E00000-0x00007FFC26E10000-memory.dmp
memory/6136-139-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-145-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-97-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-100-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-104-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-102-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-107-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-109-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-110-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-112-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-136-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-0-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-140-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-143-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-146-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-95-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-150-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-148-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-153-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-155-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-157-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-158-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-1043-0x0000000000E20000-0x0000000000F4F000-memory.dmp
memory/6136-1716-0x0000000000E20000-0x0000000000F4F000-memory.dmp
memory/6136-93-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-91-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-72-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-60-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-56-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-48-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-36-0x0000000001D30000-0x0000000001D5D000-memory.dmp
memory/6136-4-0x0000000001D30000-0x0000000001D5D000-memory.dmp