search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.57k stars 1.71k forks source link

Error starting Virtual Machine! #1671

Closed ebolanoso closed 7 years ago

ebolanoso commented 7 years ago

Can you help me please, i am trying to run cuckoo, but it shows me the following error:

Host> Ubuntu 17.04 Guest> Windows 7 SP1 x64

//\ //\//\ //\ //\//\ //\ /_/\ \:::\/ \:\ \:\ \:::\/ \::.\ \ \ \::: \ \::: \ \ \:\ \ \:\ \:\ \:\ \ _\:: \/) \ \:\ \ \ \:\ \ \ \ \:\ \//\:\ \:\ \:\ \//\:. ( ( \:\ \ \ \:\ \ \ \ \:_\ \ \:_\:\ \:_\ \ \: \ ) \ \ \:_\ \ \:_\ \ \ _\/ _\/ _\/ _\/_\/ _\/ _____\/

Cuckoo Sandbox 2.0.3 www.cuckoosandbox.org Copyright (c) 2010-2017

Checking for updates... You're good to go! 2017-06-21 13:24:54,269 [cuckoo.core.startup] INFO: Updated running task ID 3 status to failed_analysis 2017-06-21 13:24:54,281 [cuckoo] WARNING: It appears that you haven't loaded any Cuckoo Signatures. Signatures are highly recommended and improve & enrich the information extracted during an analysis. They also make up for the analysis score that you see in the Web Interface - so, pretty important! 2017-06-21 13:24:54,281 [cuckoo] WARNING: You'll be able to fetch all the latest Cuckoo Signaturs, Yara rules, and more goodies by running the following command: 2017-06-21 13:24:54,281 [cuckoo] INFO: $ cuckoo community 2017-06-21 13:24:54,283 [cuckoo.core.scheduler] INFO: Using "vmware" as machine manager 2017-06-21 13:24:54,634 [cuckoo.core.scheduler] INFO: Loaded 1 machine/s 2017-06-21 13:24:54,648 [cuckoo.core.scheduler] INFO: Waiting for analysis tasks. 2017-06-21 13:25:18,198 [cuckoo.core.scheduler] INFO: Starting analysis of FILE "ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18" (task #4, options "enable-services=False,procmemdump=yes,route=none") 2017-06-21 13:25:18,278 [cuckoo.core.scheduler] INFO: Task #4: acquired machine Windows 7 x64 (label=/home/cuckoo/vmware/Windows 7 x64/Windows 7 x64.vmx) 2017-06-21 13:25:18,294 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 5859 (interface=vmnet1, host=192.168.241.129, pcap=/home/cuckoo/.cuckoo/storage/analyses/4/dump.pcap) 2017-06-21 13:25:19,094 [cuckoo.core.scheduler] ERROR: Error starting Virtual Machine! VM: Windows 7 x64, error: Unable to revert snapshot for machine /home/cuckoo/vmware/Windows 7 x64/Windows 7 x64.vmx: vmrun exited with error 2017-06-21 13:25:20,592 [cuckoo.core.scheduler] ERROR: Failure in AnalysisManager.run Traceback (most recent call last): File "/home/cuckoo/.local/lib/python2.7/site-packages/cuckoo/core/scheduler.py", line 697, in run self.launch_analysis() File "/home/cuckoo/.local/lib/python2.7/site-packages/cuckoo/core/scheduler.py", line 564, in launch_analysis machinery.dump_memory(self.machine.label, dump_path) File "/home/cuckoo/.local/lib/python2.7/site-packages/cuckoo/machinery/vmware.py", line 199, in dump_memory key=os.path.getctime) ValueError: max() arg is an empty sequence

jbremer commented 7 years ago

It seems that VMWare is having issues trying to start the VM. Did you properly configure it?

ebolanoso commented 7 years ago

Thanks for your answer. I solve the problem by setting a configuration in vmware.conf. Regards.

jbremer commented 7 years ago

Which configuration value would that be? And to what value? Thanks!

ebolanoso commented 7 years ago

The name of the snapshot. The name of the snapshot in vmware.conf was different from the name that i placed in VMWare Workstation. Regards