search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.53k stars 1.7k forks source link

Cuckoo not starting AnalysisManager thread (Windows 10) #2633

Open Tigzy opened 5 years ago

Tigzy commented 5 years ago

Hello, I have issue when starting Cuckoo from a Scheduled Task (tried w/ and w/out admin rights) When I start manually (from explorer.exe then) it works as expected.

I've been able to isolate the issue in scheduler.py on this line:

image

It looks like the code under AnalysisManager.run() is NEVER HIT. I tried to switch deamon to False, doesn't change anything.

Here's the logs: 

2019-02-01 18:01:32,983 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_di.yar
2019-02-01 18:01:32,983 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_empire.yar
2019-02-01 18:01:32,983 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_meterpreter.yar
2019-02-01 18:01:32,983 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_txt_c2.yar
2019-02-01 18:01:32,983 [cuckoo.core.startup] DEBUG:     |-- scripts powershell_unicorn.yar
2019-02-01 18:01:32,983 [cuckoo.core.startup] DEBUG:     |-- scripts powerworm.yar
2019-02-01 18:01:32,999 [cuckoo.core.startup] DEBUG:     |-- shellcode metasploit.yar
2019-02-01 18:01:32,999 [cuckoo.core.startup] DEBUG:     |-- office dde.yar
2019-02-01 18:01:32,999 [cuckoo.core.startup] DEBUG:     |-- office ole.yar
2019-02-01 18:01:32,999 [cuckoo.core.resultserver] DEBUG: ResultServer running on 192.168.2.22:2042.
2019-02-01 18:01:32,999 [cuckoo.core.scheduler] INFO: Using "vmware" as machine manager
2019-02-01 18:01:33,538 [cuckoo.core.scheduler] INFO: Loaded 1 machine/s
2019-02-01 18:01:33,569 [cuckoo.core.scheduler] INFO: Waiting for analysis tasks.
2019-02-01 18:01:50,382 [cuckoo.core.scheduler] DEBUG: Processing task #43
2019-02-01 18:01:50,382 [cuckoo.core.scheduler] DEBUG: Trying to start the worker thread
2019-02-01 18:01:50,398 [cuckoo.core.scheduler] DEBUG: Initialize AnalysisManager
2019-02-01 18:01:50,398 [cuckoo.core.scheduler] DEBUG: Trying to start the worker thread (post-call)

Any help?

Tigzy commented 5 years ago

So I found the issue is again with precompiled cuckoo.exe, because when I use this command it works: start python.exe C:\Python27\Lib\site-packages\cuckoo\main.py --debug <= Working under scheduled task cuckoo --debug <= Not working under scheduled task