CERT-Polska / drakvuf-sandbox

DRAKVUF Sandbox - automated hypervisor-level malware analysis system
https://drakvuf-sandbox.readthedocs.io/
Other
1k stars 140 forks source link

Unable to analyze #875

Closed RyanInsolencee closed 4 months ago

RyanInsolencee commented 4 months ago

Downloaded and setup drakvuf according to the manual running on ubuntu 20.04 with win10 22H2

Tried to run an analysis but got back error [2024-03-08 11:56:23,190][ERROR] Analysis attempt failed. Retrying... Mar 08 11:56:23 f12drakvuf drakrun[2603]: Traceback (most recent call last): Mar 08 11:56:23 f12drakvuf drakrun[2603]: File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/main.py", line 743, in process Mar 08 11:56:23 f12drakvuf drakrun[2603]: info = self.analyze_sample( Mar 08 11:56:23 f12drakvuf drakrun[2603]: File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/main.py", line 590, in analyze_sample Mar 08 11:56:23 f12drakvuf drakrun[2603]: result = injector.write_file( Mar 08 11:56:23 f12drakvuf drakrun[2603]: File "/opt/venvs/drakrun/lib/python3.8/site-packages/drakrun/injector.py", line 57, in write_file Mar 08 11:56:23 f12drakvuf drakrun[2603]: return subprocess.run( Mar 08 11:56:23 f12drakvuf drakrun[2603]: File "/usr/lib/python3.8/subprocess.py", line 495, in run Mar 08 11:56:23 f12drakvuf drakrun[2603]: stdout, stderr = process.communicate(input, timeout=timeout) Mar 08 11:56:23 f12drakvuf drakrun[2603]: File "/usr/lib/python3.8/subprocess.py", line 1028, in communicate Mar 08 11:56:23 f12drakvuf drakrun[2603]: stdout, stderr = self._communicate(input, endtime, timeout) Mar 08 11:56:23 f12drakvuf drakrun[2603]: File "/usr/lib/python3.8/subprocess.py", line 1869, in _communicate Mar 08 11:56:23 f12drakvuf drakrun[2603]: self._check_timeout(endtime, orig_timeout, stdout, stderr) Mar 08 11:56:23 f12drakvuf drakrun[2603]: File "/usr/lib/python3.8/subprocess.py", line 1072, in _check_timeout Mar 08 11:56:23 f12drakvuf drakrun[2603]: raise TimeoutExpired( Mar 08 11:56:23 drakvuf drakrun[2603]: subprocess.TimeoutExpired: Command '['injector', '-o', 'json', '-d', 'vm-1', '-r', '/var/lib/drakrun/profiles/kernel.json', '-i', '5376', '-k', '0x1aa002', '-m', 'writefile', '-e', '%USERPROFILE%\\Desktop\\opera.exe', '-B', '/tmp/drakrun/vm-1/opera.exe']' timed out after 60 seconds'/tmp/drakrun/vm-1/opera.

this is my first time setting this up so im really clueless of whats the problem here help is much appreciated

RyanInsolencee commented 4 months ago

worked after reboot