cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.56k stars 1.7k forks source link

Baseline Module fail with plugins #2731

Open Marcus-D opened 5 years ago

Marcus-D commented 5 years ago

Thanks for creating an issue! But first: did you read our community guidelines? https://cuckoo.sh/docs/introduction/community.html

My issue is:

Baseline module throws a python error: KeyError: 'apihook'

My Cuckoo version and operating system are:

Cuckoo Sandbox 2.0.6.2 Guest: Windows 7 x64 Pro Host: Ubuntu 18.04 Agent: 0.8

This can be reproduced by:

In the config, enable apihooks with filtering, baseline, and memory. Try running a sample.doc with MS 2013 and leave the package type as default.

The log, error, files etc can be found at:

Cuckoo log 2019-05-12 21:16:11,267 [cuckoo.core.scheduler] INFO: Task #17: acquired machine win7 (label=win7) 2019-05-12 21:16:11,271 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Services 2019-05-12 21:16:11,284 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 12892 (interface=vboxnet0, host=192.168.56.101) 2019-05-12 21:16:11,286 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer 2019-05-12 21:16:11,343 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7 2019-05-12 21:16:11,582 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7 to its current snapshot 2019-05-12 21:16:17,888 [cuckoo.core.guest] INFO: Starting analysis on guest (id=win7, ip=192.168.56.101) 2019-05-12 21:16:18,893 [cuckoo.core.guest] DEBUG: win7: not ready yet 2019-05-12 21:16:19,903 [cuckoo.core.guest] DEBUG: win7: not ready yet 2019-05-12 21:16:20,909 [cuckoo.core.guest] DEBUG: win7: not ready yet 2019-05-12 21:16:20,929 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.8 (id=win7, ip=192.168.56.101) 2019-05-12 21:16:21,036 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7, ip=192.168.56.101, monitor=latest, size=3967696) 2019-05-12 21:16:21,472 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:21,745 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized. 2019-05-12 21:16:22,498 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:23,534 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:23,953 [cuckoo.core.resultserver] DEBUG: New process (pid=532, ppid=3016, name=WINWORD.EXE) 2019-05-12 21:16:24,550 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:24,892 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0001.jpg 2019-05-12 21:16:24,905 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30483 2019-05-12 21:16:25,561 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:25,938 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0002.jpg 2019-05-12 21:16:25,957 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 28708 2019-05-12 21:16:26,574 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:26,980 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0003.jpg 2019-05-12 21:16:27,008 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 29117 2019-05-12 21:16:27,584 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:28,594 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:29,606 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:30,615 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:31,626 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:32,639 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:33,652 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:34,661 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:35,674 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:36,684 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:37,694 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:38,704 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:39,717 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:40,727 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:41,737 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:42,747 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:43,759 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:44,771 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:45,781 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:46,791 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:47,803 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:48,814 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:49,826 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:50,839 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:51,851 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:52,864 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:53,876 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:54,885 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:55,894 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:56,904 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:57,914 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:58,928 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:16:59,384 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0004.jpg 2019-05-12 21:16:59,402 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 29706 2019-05-12 21:16:59,938 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:00,409 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0005.jpg 2019-05-12 21:17:00,422 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 29289 2019-05-12 21:17:00,947 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:01,957 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:02,970 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:03,983 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:04,992 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:06,003 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:07,014 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:08,024 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:09,038 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:10,050 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:11,062 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:12,073 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:13,085 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:14,098 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:15,107 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:16,119 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:17,131 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:18,141 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:19,153 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:20,163 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:21,174 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:22,185 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:23,197 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:24,212 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:25,221 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:26,234 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:27,247 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:27,581 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0006.jpg 2019-05-12 21:17:27,597 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30703 2019-05-12 21:17:28,260 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:29,273 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:30,283 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:31,292 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:32,301 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:33,311 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:34,323 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:35,333 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:36,342 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:37,352 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:38,363 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:39,372 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:39,702 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0007.jpg 2019-05-12 21:17:39,723 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31171 2019-05-12 21:17:40,381 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:40,737 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0008.jpg 2019-05-12 21:17:40,749 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30703 2019-05-12 21:17:41,391 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:42,400 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:43,410 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:44,423 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:45,433 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:46,443 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:47,454 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:48,466 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:49,479 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:50,488 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:51,499 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:52,508 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:53,519 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:54,535 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:55,548 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:56,559 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:57,570 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:58,582 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:17:59,598 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:00,610 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:01,621 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:02,630 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:03,641 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:04,656 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:05,665 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:06,674 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:07,686 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:08,696 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:09,709 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:10,720 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:11,732 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:12,744 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:13,756 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:14,769 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:15,778 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:16,789 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:17,797 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:18,809 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:19,820 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:20,834 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:21,847 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:22,857 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:23,867 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:24,879 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:25,890 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:26,900 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:27,918 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:28,927 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:29,941 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:30,953 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:31,967 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:32,977 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:33,988 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:35,000 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:36,009 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:37,019 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:38,030 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:39,043 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:40,053 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:41,061 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:42,072 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:43,081 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:44,091 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:45,103 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:46,113 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:47,125 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:48,135 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:48,202 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0009.jpg 2019-05-12 21:18:48,230 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31027 2019-05-12 21:18:49,145 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:49,238 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0010.jpg 2019-05-12 21:18:49,254 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30710 2019-05-12 21:18:50,155 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:51,166 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:52,178 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:53,188 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:54,197 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:55,206 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:56,217 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:57,232 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:58,242 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:18:59,253 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:00,266 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:01,279 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:02,292 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:03,301 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:04,311 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:05,325 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:06,336 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:07,350 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:08,359 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:09,368 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:10,379 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:11,390 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:12,403 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:13,414 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:14,425 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:15,435 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:16,445 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:17,457 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:18,466 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:19,477 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:20,488 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:21,499 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:22,512 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:23,524 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:24,406 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0011.jpg 2019-05-12 21:19:24,436 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31987 2019-05-12 21:19:24,534 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:25,457 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0012.jpg 2019-05-12 21:19:25,471 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30711 2019-05-12 21:19:25,547 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:26,557 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:27,502 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0013.jpg 2019-05-12 21:19:27,515 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31021 2019-05-12 21:19:27,565 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:28,546 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0014.jpg 2019-05-12 21:19:28,575 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30711 2019-05-12 21:19:28,582 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:29,595 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:30,606 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:31,614 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:32,626 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:33,638 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:34,650 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:35,661 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:36,671 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:37,683 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:38,695 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:39,708 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:40,717 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:41,727 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:42,739 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:43,751 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:44,761 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:45,770 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:46,780 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:47,793 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:48,802 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:49,813 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:50,821 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:51,830 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:52,844 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:53,854 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:54,863 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:55,872 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:56,785 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0015.jpg 2019-05-12 21:19:56,803 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31181 2019-05-12 21:19:56,882 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:57,815 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0016.jpg 2019-05-12 21:19:57,833 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30711 2019-05-12 21:19:57,895 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:58,905 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:19:59,913 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:00,921 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:01,930 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:02,942 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:03,954 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:04,966 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:05,976 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:06,894 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0017.jpg 2019-05-12 21:20:06,910 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31181 2019-05-12 21:20:06,987 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:07,925 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0018.jpg 2019-05-12 21:20:07,935 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30711 2019-05-12 21:20:08,001 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:09,011 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:10,020 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:11,029 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:12,039 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:13,051 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:14,060 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:15,046 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0019.jpg 2019-05-12 21:20:15,068 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31021 2019-05-12 21:20:15,072 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:16,081 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0020.jpg 2019-05-12 21:20:16,095 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30710 2019-05-12 21:20:16,103 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:17,124 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:18,136 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:19,145 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:20,155 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:21,164 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:22,173 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:23,185 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:24,197 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:25,209 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:26,220 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:27,233 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:28,242 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:29,253 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:30,264 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:31,273 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:32,285 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:33,295 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:34,305 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:35,315 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:36,324 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:37,334 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:38,285 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0021.jpg 2019-05-12 21:20:38,297 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31021 2019-05-12 21:20:38,343 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:39,315 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0022.jpg 2019-05-12 21:20:39,343 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30710 2019-05-12 21:20:39,353 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:40,370 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:41,385 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:42,397 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:43,409 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:44,418 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:45,433 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:46,407 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0023.jpg 2019-05-12 21:20:46,429 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31174 2019-05-12 21:20:46,443 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:47,440 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0024.jpg 2019-05-12 21:20:47,454 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30710 2019-05-12 21:20:47,462 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:48,474 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:49,474 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0025.jpg 2019-05-12 21:20:49,488 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 31174 2019-05-12 21:20:49,495 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:50,504 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0026.jpg 2019-05-12 21:20:50,516 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 30710 2019-05-12 21:20:50,524 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:51,541 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:52,551 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:53,561 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:54,573 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:55,583 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:56,593 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:57,602 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:58,611 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:20:59,626 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:00,639 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:01,647 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:02,656 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:03,665 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:04,677 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:05,689 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:06,699 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:07,709 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:08,720 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:09,735 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:10,748 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:11,757 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:12,767 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:13,776 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:14,789 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:15,800 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:16,811 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:17,820 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:18,829 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:19,843 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:20,853 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:21,861 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:22,872 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:23,882 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:24,893 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:25,907 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:26,921 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:27,934 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:28,946 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:29,958 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:30,971 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:31,986 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:32,837 [cuckoo.core.resultserver] DEBUG: File upload request for memory/532-1.dmp 2019-05-12 21:21:33,023 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:33,858 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 238635768 2019-05-12 21:21:34,036 [cuckoo.core.guest] DEBUG: win7: analysis still processing 2019-05-12 21:21:35,042 [cuckoo.core.guest] INFO: win7: analysis completed successfully 2019-05-12 21:21:35,058 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Services 2019-05-12 21:21:35,098 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2019-05-12 21:21:50,373 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7 to path /home/test/.cuckoo/storage/analyses/17/memory.dmp 2019-05-12 21:21:50,638 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7 2019-05-12 21:21:52,984 [cuckoo.core.scheduler] DEBUG: Released database task #17 2019-05-12 21:21:53,024 [cuckoo.core.plugins] DEBUG: Executed processing module "AnalysisInfo" for task #17 2019-05-12 21:21:53,029 [cuckoo.core.plugins] DEBUG: Executed processing module "BehaviorAnalysis" for task #17 2019-05-12 21:21:53,030 [cuckoo.core.plugins] DEBUG: Executed processing module "Dropped" for task #17 2019-05-12 21:21:53,031 [cuckoo.core.plugins] DEBUG: Executed processing module "DroppedBuffer" for task #17 2019-05-12 21:21:57,836 [cuckoo.processing.memory] DEBUG: Executing volatility 'pslist' module. 2019-05-12 21:21:59,030 [cuckoo.processing.memory] DEBUG: Executing volatility 'psxview' module. 2019-05-12 21:22:22,717 [cuckoo.processing.memory] DEBUG: Executing volatility 'callbacks' module. 2019-05-12 21:22:49,756 [cuckoo.processing.memory] DEBUG: Executing volatility 'ssdt' module. 2019-05-12 21:22:58,088 [cuckoo.processing.memory] DEBUG: Executing volatility 'timers' module. 2019-05-12 21:55:04,270 [cuckoo.processing.memory] DEBUG: Executing volatility 'messagehooks' module. 2019-05-12 21:56:50,571 [cuckoo.processing.memory] DEBUG: Executing volatility 'getsids' module. 2019-05-12 21:56:54,547 [cuckoo.processing.memory] DEBUG: Executing volatility 'privs' module. 2019-05-12 21:56:59,377 [cuckoo.processing.memory] DEBUG: Executing volatility 'malfind' module. 2019-05-12 21:57:16,349 [cuckoo.processing.memory] DEBUG: Executing volatility 'apihooks' module. 2019-05-12 22:58:43,964 [cuckoo.processing.memory] DEBUG: Executing volatility 'dlllist' module. 2019-05-12 22:58:51,183 [cuckoo.processing.memory] DEBUG: Executing volatility 'handles' module. 2019-05-12 23:00:22,901 [cuckoo.processing.memory] DEBUG: Executing volatility 'ldrmodules' module. 2019-05-12 23:01:00,676 [cuckoo.processing.memory] DEBUG: Executing volatility 'mutantscan' module. 2019-05-12 23:01:06,508 [cuckoo.processing.memory] DEBUG: Executing volatility 'devicetree' module. 2019-05-12 23:01:12,064 [cuckoo.processing.memory] DEBUG: Executing volatility 'svcscan' module. 2019-05-12 23:01:18,165 [cuckoo.processing.memory] DEBUG: Executing volatility 'modscan' module. 2019-05-12 23:01:23,375 [cuckoo.processing.memory] DEBUG: Executing volatility 'yarascan' module. 2019-05-12 23:03:07,252 [cuckoo.processing.memory] DEBUG: Executing volatility 'netscan' module. 2019-05-12 23:03:14,163 [cuckoo.core.plugins] DEBUG: Executed processing module "Memory" for task #17 2019-05-12 23:03:23,386 [cuckoo.core.plugins] DEBUG: Executed processing module "MetaInfo" for task #17 2019-05-12 23:04:25,521 [cuckoo.core.plugins] DEBUG: Executed processing module "ProcessMemory" for task #17 2019-05-12 23:04:25,522 [cuckoo.core.plugins] DEBUG: Executed processing module "Procmon" for task #17 2019-05-12 23:04:25,872 [cuckoo.core.plugins] DEBUG: Executed processing module "Screenshots" for task #17 2019-05-12 23:04:25,899 [cuckoo.core.plugins] DEBUG: Executed processing module "Static" for task #17 2019-05-12 23:04:25,917 [cuckoo.core.plugins] DEBUG: Executed processing module "Strings" for task #17 2019-05-12 23:04:25,924 [cuckoo.core.plugins] DEBUG: Executed processing module "TargetInfo" for task #17 2019-05-12 23:04:50,683 [cuckoo.core.plugins] ERROR: Failed to run the processing module "Baseline" for task #17: Traceback (most recent call last): File "/home/test/.local/lib/python2.7/site-packages/cuckoo/core/plugins.py", line 241, in process data = current.run() File "/home/test/.local/lib/python2.7/site-packages/cuckoo/processing/baseline.py", line 119, in run self.memory(self.baseline["memory"], self.results["memory"]) File "/home/test/.local/lib/python2.7/site-packages/cuckoo/processing/baseline.py", line 56, in memory lb = [self.normalize(plugin, x) for x in baseline[plugin]["data"]] KeyError: 'apihooks' 2019-05-12 23:04:50,842 [cuckoo.core.plugins] DEBUG: Executed processing module "NetworkAnalysis" for task #17 2019-05-12 23:04:51,386 [cuckoo.core.plugins] DEBUG: Executed processing module "VirusTotal" for task #17 2019-05-12 23:04:51,386 [cuckoo.core.plugins] DEBUG: Executed processing module "Extracted" for task #17 2019-05-12 23:04:51,387 [cuckoo.core.plugins] DEBUG: Executed processing module "TLSMasterSecrets" for task #17 2019-05-12 23:04:51,394 [cuckoo.core.plugins] DEBUG: Executed processing module "Debug" for task #17 2019-05-12 23:04:51,400 [cuckoo.core.plugins] DEBUG: Running 540 signatures 2019-05-12 23:04:52,095 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivirus_virustotal 2019-05-12 23:04:52,098 [cuckoo.core.plugins] DEBUG: Analysis matched signature: memdump_urls 2019-05-12 23:04:52,100 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_handles_1 2019-05-12 23:04:52,103 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_ldrmodules_1 2019-05-12 23:04:52,107 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_malfind_2 2019-05-12 23:04:52,108 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_svcscan_1 2019-05-12 23:04:52,110 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_svcscan_3 2019-05-12 23:04:55,639 [cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump" 2019-05-12 23:04:55,816 [cuckoo.core.plugins] DEBUG: Executed reporting module "SingleFile"

Cuckoo analyzer 2019-05-12 21:16:11,062 [analyzer] DEBUG: Starting analyzer from: C:\tmpagf60d 2019-05-12 21:16:11,062 [analyzer] DEBUG: Pipe server name: \??\PIPE\zTnvvShHnLffztGdFPxth 2019-05-12 21:16:11,062 [analyzer] DEBUG: Log pipe server name: \??\PIPE\ogOVlbWaRRLjkMqZnkpGUEvLDhpmXfNb 2019-05-12 21:16:11,250 [analyzer] DEBUG: Started auxiliary module DbgView 2019-05-12 21:16:12,171 [analyzer] DEBUG: Started auxiliary module Disguise 2019-05-12 21:16:12,530 [analyzer] DEBUG: Loaded monitor into process with pid 460 2019-05-12 21:16:12,562 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets 2019-05-12 21:16:12,578 [analyzer] DEBUG: Started auxiliary module Human 2019-05-12 21:16:12,578 [analyzer] DEBUG: Started auxiliary module InstallCertificate 2019-05-12 21:16:12,578 [analyzer] DEBUG: Started auxiliary module Reboot 2019-05-12 21:16:12,858 [analyzer] DEBUG: Started auxiliary module RecentFiles 2019-05-12 21:16:12,905 [analyzer] DEBUG: Started auxiliary module Screenshots 2019-05-12 21:16:12,905 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n 2019-05-12 21:16:13,125 [lib.api.process] INFO: Successfully executed process from path 'C:\Program Files\Microsoft Office\Office15\WINWORD.EXE' with arguments [u'C:\Users\redpand\AppData\Local\Temp\Dwork.doc'] and pid 532 2019-05-12 21:16:13,265 [analyzer] DEBUG: Loaded monitor into process with pid 532 2019-05-12 21:17:16,780 [modules.auxiliary.human] INFO: Closed Office window. 2019-05-12 21:21:12,592 [analyzer] INFO: Analysis timeout hit, terminating analysis. 2019-05-12 21:21:23,375 [lib.api.process] INFO: Memory dump of process with pid 532 completed 2019-05-12 21:21:23,375 [analyzer] INFO: Analysis completed.

githule commented 4 years ago

Hello,

I am having a probably similar problem with 2.0.6. As an example, svcscan returns the SharedAccess service as stopped in both the baseline job and in a malware analysis for a healthy sample.

This match with the rule "Stopped Firewall Service" signature as I disabled this service in my VM

Where do the solution must be coded ?

Thanks for your help,