a867deb1...fb02

VTI SCORE: 100/100

Dynamic Analysis Report

Classification: Wiper, Ransomware

a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02 (SHA256)

SCN0tification.exe

Windows Exe (x86-32)

Created at 2019-03-02 17:30:00

Notifications (2/2)

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

The overall sleep time of all monitored processes was truncated from "12 hours, 46 minutes" to "6 minutes, 30 seconds" to reveal dormant functionality.

Severity	Category	Operation	Classification
5/5	File System	Encrypts content of user files	Ransomware
Encrypts the content of multiple user files. This is an indicator for ransomware. ... VTI Actions Go to function call
2/5	Anti Analysis	Delays execution	-
One thread sleeps more than 5 minutes. ... VTI Actions Go to function call
1/5	Anti Analysis	Resolves APIs dynamically	-
Resolves an unusually high number of APIs. ... VTI Actions Go to function call
1/5	Process	Creates process with hidden window	-
The process "C:\Users\CIiHmnxMn6Ps\Desktop\clearnetworkdns_11-22-33.bat" starts with hidden window. ... VTI Actions Go to function call
1/5	Process	Creates system object	-
Creates mutex with name "^_-HappyLife^_-". ... VTI Actions Go to function call
1/5	File System	Creates an unusually large number of files	-
Creates an unusually large number of files. ... VTI Actions Go to file details Go to function call

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (2/2)

Before

After