search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.55k stars 1.71k forks source link

Cuckoo Error during URL analysis #2168

Open ghost opened 6 years ago

ghost commented 6 years ago

I configured cuckoo sandbox with windows and ubuntu. My sample analysis are done properly and I am able to generate reports. But when I submit a URL internet explorer does not open and the vm quits immediately as the analysis starts.

Cuckoo version : 2.0.5 OS : Ubuntu 14.04

Attached the cuckoo log cuckoo.log

lillypad commented 6 years ago

Hello @vikaskarunakaran,

Does your guest windows machine have admin rights by default?

SetValueEx(key_handle, key, 0, REG_DWORD, value)
WindowsError: [Error 5] Access is denied

Accessing the windows registry requires admin rights.

This article may help: https://superuser.com/questions/1002262/run-applications-as-administrator-by-default-in-windows-10

RicoVZ commented 6 years ago

Hi vikaskarunakaran,

What @lillypad says is correct. Some Cuckoo analysis packages modify the registry before they run a sample or open a URL. This always happens for URL analyses. It seems the analysis package crashes (because it not allowed to modify the registry), which causes the analysis to fail.

Can you try running the Agent as admin or in the Admin account and try again?

ghost commented 6 years ago

Thanks @lillypad and @RicoVZ . I have fixed it but now the Internet explorer inside the VM crashes when I submit the URL. I can manually open IE from command line in the VM but when cuckoo issues command to open the URL with IE, the browser crashes.

Any idea, what could have gone wrong ?

JuggeM commented 5 years ago

Turning off UAC sloved this for me.