Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\lynxguard
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
adds antivirus exclusion with following registry keys:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{401A0D74-09A8-4C7B-8551-BD348C2A9A06}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
- [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions] 'exe' = ''
Injects code into
the following user processes:
- www.pif
Modifies file system
Creates the following files
- %TEMP%\7zipsfx.000\blowjob
- <SYSTEM32>\grouppolicy\machine\registry.pol
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %LOCALAPPDATA%\threatguard innovations\lynxguard.js
- %LOCALAPPDATA%\threatguard innovations\lynxguard.pif
- %LOCALAPPDATA%\threatguard innovations\u
- %TEMP%\7zipsfx.000\14623\w
- %TEMP%\7zipsfx.000\14623\www.pif
- %TEMP%\7zipsfx.000\vp
- %TEMP%\7zipsfx.000\therefore
- %TEMP%\7zipsfx.000\taiwan
- %TEMP%\7zipsfx.000\seems
- %TEMP%\7zipsfx.000\racks
- %TEMP%\7zipsfx.000\protest
- %TEMP%\7zipsfx.000\packed
- %TEMP%\7zipsfx.000\insights
- %TEMP%\7zipsfx.000\hawaii
- %TEMP%\7zipsfx.000\flux
- %TEMP%\7zipsfx.000\congressional
- %TEMP%\7zipsfx.000\businesses
- <SYSTEM32>\grouppolicy\gpt.ini
- %ALLUSERSPROFILE%\ntuser.pol
Deletes the following files
- %TEMP%\7zipsfx.000\14623\w
- %TEMP%\7zipsfx.000\14623\www.pif
Moves the following files
- from %TEMP%\7zipsfx.000\blowjob to %TEMP%\7zipsfx.000\blowjob.bat
Network activity
Connects to
- '19#.#33.132.211':50500
UDP
- DNS ASK rN#############siVyrnqNBedn.rNBwJnisUDYIZkhsiVyrnqNBedn
Miscellaneous
Creates and executes the following
- '%TEMP%\7zipsfx.000\14623\www.pif' 14623\W
- '%WINDIR%\syswow64\cmd.exe' /k move Blowjob Blowjob.bat & Blowjob.bat & exit' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "LynxGuard" /tr "wscript '%LOCALAPPDATA%\ThreatGuard Innovations\LynxGuard.js'" /sc onlogon /F /RL HIGHEST' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /k move Blowjob Blowjob.bat & Blowjob.bat & exit
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\findstr.exe' /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
- '%WINDIR%\syswow64\findstr.exe' /I "wrsa.exe opssvc.exe"
- '%WINDIR%\syswow64\cmd.exe' /c md 14623
- '%WINDIR%\syswow64\cmd.exe' /c copy /b Businesses + Flux + Protest + Hawaii + Vp + Insights 14623\Ww#.pif
- '%WINDIR%\syswow64\cmd.exe' /c copy /b Congressional + Seems + Racks + Packed + Taiwan + Therefore 14623\W
- '%WINDIR%\syswow64\ping.exe' -n 15 localhost
- '%WINDIR%\syswow64\schtasks.exe' /create /tn "LynxGuard" /tr "wscript '%LOCALAPPDATA%\ThreatGuard Innovations\LynxGuard.js'" /sc onlogon /F /RL HIGHEST
- '<SYSTEM32>\svchost.exe' -k secsvcs
- '<SYSTEM32>\raserver.exe' /offerraupdate
