Cuckoo: is32bit.exe warning (and analysis failure due timeout)

[lopoc]

hi mates,

I'm not new to cuckoo, but during my last installation(1.2) and its testing I've faced an issue cannot understand well from what it is triggered.

here is a piece of log found as output of an analysis:
2015-12-14 21:21:51,361 [analyzer] WARNING: Cannot execute auxiliary module DumpTLSMasterSecrets: Error returned by is32bit: Command '['bin\\is32bit.exe', '-n', 'lsass.exe']' returned non-zero exit status 1

Let me explain in details what happens; once submitted a sample, the analysis terminate due to timeout.
Jumped into the VM, there is an alert box on the desktop, issued by isbit32.exe, displaying:
" [-] Error getting access to process: 5! ".

Once clicked on ok, the analysis process "wakes up" and terminate providing the expected report.

for any further information about my setup, ask.

[jbremer]

Does the Cuckoo Agent have administrator privileges?

[lopoc]

actually no.
I've supposed it'd be due to privileges, but tried running manually the command is32bit.exe -n lsass.exe from an administrative command and it raised the same error.

[jbremer]

Do you have UAC etc enabled? Tried disabling that?

[lopoc]

well, it's working right now, disabling UAC and running the agent as administrator.
thank you.

I'm just wondering how correct is turning off UAC on a machine that should mimic a production one with UAC enabled?

[jbremer]

We're happy to talk about workarounds with UAC enabled but at the moment I don't see any easy way to do so - if you do, let us know :-)

[lopoc]

got it ;)
maybe it could be usefull a note on the documentation.

thank u

[jbremer]

Yeah, or even better; a message at runtime if you see this, please disable UAC and if you see this, please run as Administrator.. :p

[geek-li]

Even .I disable the UAC there is a same error dialog :(,how to fix this issue

[Jack28]

I had the same problem.
It finally stated working after I granted permission for "Debuggen von Programmen" (German. approx. Debugging of Programms) to Administrators.
Similar to https://technet.microsoft.com/en-us/library/cc776977(WS.10).aspx

It required that change and the agent.py to be executed from the Powershell rather than cmd.exe

[candrei]

I had to 'relax' the security by disabling UAC via _User Account Control: Run all administrators in Admin Approval Mode_ under _ Local Policies -> Security Options_ via _Local Security Policy_ utility.