Cuckoo: Error Running certain EXE files

[fez219]

Hello,

I'm just starting to actually test my sandbox with real malware. I'm also running into issues.

So far, I've been able to run safe .exe files through the sandbox with no issues. However, when I try to run an actual malware sample (also a .exe), I get a stranger error.

My Windows 7 guest gives me this error message:

Inject error

[-] Error adding task to APC queue: %Id

I can't find the solution to this error anywhere. Help would be greatly appreciated!

Thanks!

-Alex

[doomedraven]

can you provide some log/hashes, more details

[fez219]

Please note that my sandbox works fine with PAfish and the installer for Notepad++. I also have my sandbox disconnected from the internet on purpose.

I'm trying to run malware with these hashes:

• MD5: bb72bed531d75dadb3587b2a1ec10da2
• SHA1: f450ebc7273d0dc1b6cebf9360ebcdbfec318d57
• SHA256: 5038e948fda799bc6b779c1c54d6a72c03a4e571615f7a5529eb5549dfb21da2

I just ran it again beginning the command with free=yes, and did not get the error. Here's the analysis.log:

2016-10-05 10:15:20,000 [analyzer] DEBUG: Starting analyzer from: C:ekmzslko
2016-10-05 10:15:20,015 [analyzer] DEBUG: Pipe server name: .PIPEWsRepawyvCeYvCWVXKgKUKqKeXrS
2016-10-05 10:15:20,015 [analyzer] DEBUG: Log pipe server name: .PIPEjtpzPRuVbIyIfgRnGdaI
2016-10-05 10:15:20,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2016-10-05 10:15:20,015 [analyzer] INFO: Automatically selected analysis package "exe"
2016-10-05 10:15:20,890 [analyzer] DEBUG: Started auxiliary module Disguise
2016-10-05 10:15:23,233 [analyzer] DEBUG: Loaded monitor into process with pid 480
2016-10-05 10:15:23,233 [lib.api.process] INFO: Successfully injected process with pid None
2016-10-05 10:15:23,233 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2016-10-05 10:15:23,233 [analyzer] DEBUG: Started auxiliary module Human
2016-10-05 10:15:23,233 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2016-10-05 10:15:23,233 [analyzer] DEBUG: Started auxiliary module Screenshots
2016-10-05 10:15:23,453 [lib.api.process] INFO: Successfully executed process from path u'C:UsersALEXAN~1AppDataLocalTempakomani.exe' with arguments '' and pid 2884
2016-10-05 10:15:27,253 [analyzer] INFO: Process with pid 2884 has terminated
2016-10-05 10:15:27,253 [analyzer] INFO: Process list is empty, terminating analysis.
2016-10-05 10:15:28,371 [analyzer] INFO: Analysis completed.

Does this look correct? Can you please explain what free=yes does (beyond just that the malware is executed freely)? The sample should be ransomware, but nothing much seems to be happening on the guest.

[doomedraven]

are you on last dev commit? or with rc1? i don't have that error with last dev commit

[fez219]

@doomedraven rc1. So you ran it without free=yes and did not receive an error message?

[doomedraven]

im on dev branch, rc1 is very old and buggy, yes without free=yes it works fine in my case

[fez219]

@doomedraven Isn't rc1 the newest stable version? It's the one advertised on Cuckoo's website as the main download, after all.

[doomedraven]

rc1 the newest stable version <- yes, but in dev there a lot of bugs fixed from rc1, so dev is more stable ;)

[fez219]

@doomedraven Alrighty. I'll download dev and see if it fixes my issues. I'll get back to you later today or tomorrow.

[fez219]

@doomedraven I went back to dev and had new errors pop up. I had problems before on dev, which is why I initially switched to rc-1. The new errors are the exact same things I had back then. See #1045 for the new problems I have.

[doomedraven]

post your logs or something?

it works perfect for me in few servers

[fez219]

@doomedraven Note, again, that I have disabled internet on purpose. Problems with items like VirusTotal are to be expected.

Dev has no problems running pafish.exe. When I try to run actual malware, things get a little haywire. Here's what happens when I run dev:

`2016-10-12 09:36:37,268 [lib.cuckoo.core.scheduler] INFO: File already exists at "/home/alexander/cuckoo/storage/binaries/5038e948fda799bc6b779c1c54d6a72c03a4e571615f7a5529eb5549dfb21da2"
2016-10-12 09:36:37,385 [lib.cuckoo.core.scheduler] INFO: Task #7: acquired machine windows7-cuckoo (label=windows7-cuckoo)
2016-10-12 09:36:37,409 [modules.auxiliary.sniffer] INFO: Started sniffer with PID 3672 (interface=vboxnet0, host=192.168.56.101, pcap=/home/alexander/cuckoo/storage/analyses/7/dump.pcap)
2016-10-12 09:36:41,977 [lib.cuckoo.core.guest] INFO: Starting analysis on guest (id=windows7-cuckoo, ip=192.168.56.101)
2016-10-12 09:36:58,618 [lib.cuckoo.core.scheduler] ERROR: Error from the Cuckoo Guest: Analysis failed: The package "modules.packages.exe" start function raised an error: Unable to execute the initial process, analysis aborted.
Traceback (most recent call last):
File "C:lexfljoanalyzer.py", line 778, in
success = analyzer.run()
File "C:lexfljoanalyzer.py", line 626, in run
(package_name, e)
CuckooError: The package "modules.packages.exe" start function raised an error: Unable to execute the initial process, analysis aborted.

2016-10-12 09:37:15,637 [modules.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label windows7-cuckoo to path /home/alexander/cuckoo/storage/analyses/7/memory.dmp
2016-10-12 09:37:27,005 [volatility.debug] WARNING: NoneObject as string: Cannot find process session
2016-10-12 09:37:27,007 [volatility.debug] WARNING: NoneObject as string: Cannot find process session
2016-10-12 09:39:31,949 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,951 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,953 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,962 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,964 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,967 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,969 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,974 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,977 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,983 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,985 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,988 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,990 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,992 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,995 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:31,997 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,002 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,005 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,023 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,026 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,028 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,031 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,043 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,046 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,048 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,050 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,053 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,055 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,057 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,062 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,065 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,067 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,070 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,072 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,075 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,078 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,081 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,089 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,092 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,094 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,096 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,102 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,108 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,115 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,121 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,135 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,154 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,157 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,159 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,161 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,174 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,176 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,179 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,181 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,184 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,186 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,188 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,191 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,194 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,196 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,199 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,202 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,220 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,237 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,240 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,250 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,252 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,258 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,260 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,263 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,266 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,269 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,272 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,281 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,284 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,287 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,289 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,292 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,294 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,298 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,301 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,304 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,306 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,314 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,316 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,326 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,336 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,338 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,341 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,344 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,346 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,352 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,354 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,360 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,363 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,370 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,372 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,375 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,378 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,380 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,383 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,388 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,394 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,398 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,413 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,422 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,425 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,432 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,434 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,437 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,440 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,446 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,449 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,451 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,457 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,460 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,463 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,466 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,475 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,488 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,491 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,501 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,505 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,508 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,510 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,513 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,516 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,518 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,521 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,527 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,531 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,534 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,536 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,547 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,550 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,552 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,555 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,558 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,561 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,564 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,571 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,588 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,595 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,605 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,607 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,613 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,619 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,622 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,625 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,628 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,631 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,634 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,637 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,640 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,646 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,648 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,651 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,668 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,683 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,686 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,689 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,692 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,699 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,702 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,705 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,708 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,711 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,715 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,718 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,721 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,724 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,727 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,734 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,740 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,743 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,750 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,753 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,756 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,763 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,773 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,780 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,782 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,789 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,799 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,805 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,811 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,814 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,817 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,821 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,824 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,827 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,830 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,833 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,836 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,839 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,841 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,848 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,855 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,858 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,869 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,872 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,879 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,882 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,885 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,895 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,898 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,918 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,925 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,929 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,932 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,935 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,950 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,954 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,957 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,960 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,962 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,969 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,972 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,975 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,978 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,982 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,985 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:32,998 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,002 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,005 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,008 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,015 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,018 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,024 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,035 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,041 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,049 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,052 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,055 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,058 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,061 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,064 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,067 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,070 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,073 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,077 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,081 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,084 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,087 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,090 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,093 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,096 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,099 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,102 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,105 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,109 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,112 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,133 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,136 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,139 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,147 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,150 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,153 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,156 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,576 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,579 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:39:33,582 [volatility.debug] WARNING: NoneObject as string: No path, service isn't running
2016-10-12 09:40:46,433 [volatility.debug] WARNING: NoneObject as string: Pointer Local invalid
2016-10-12 09:40:46,441 [volatility.debug] WARNING: NoneObject as string: Pointer Local invalid
2016-10-12 09:40:46,445 [volatility.debug] WARNING: NoneObject as string: Pointer Local invalid
2016-10-12 09:40:46,455 [volatility.debug] WARNING: NoneObject as string: Pointer Local invalid
2016-10-12 09:40:47,160 [modules.processing.virustotal] WARNING: Error fetching results from VirusTotal for "5038e948fda799bc6b779c1c54d6a72c03a4e571615f7a5529eb5549dfb21da2": Unable to fetch VirusTotal results: MaxRetryError("HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /vtapi/v2/file/report (Caused by NewConnectionError(': Failed to establish a new connection: [Errno -3] Temporary failure in name resolution',))",)
2016-10-12 09:40:50,694 [lib.cuckoo.core.scheduler] INFO: Task #7: reports generation completed (path=/home/alexander/cuckoo/storage/analyses/7)
2016-10-12 09:40:50,831 [lib.cuckoo.core.scheduler] INFO: Task #7: analysis procedure completed`

Then here's my results from my analysis.log:
2016-10-12 09:36:36,000 [analyzer] DEBUG: Starting analyzer from: C:\lexfljo 2016-10-12 09:36:36,030 [analyzer] DEBUG: Pipe server name: \\.\PIPE\RWfSAgBrUIyUWCdbXVnlwtyKGh 2016-10-12 09:36:36,030 [analyzer] DEBUG: Log pipe server name: \\.\PIPE\PbTArVytmpnebwFuvkWGIzGttKSPSLqK 2016-10-12 09:36:36,030 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically. 2016-10-12 09:36:36,030 [analyzer] INFO: Automatically selected analysis package "exe" 2016-10-12 09:36:40,717 [analyzer] DEBUG: Started auxiliary module Disguise 2016-10-12 09:36:41,062 [analyzer] DEBUG: Loaded monitor into process with pid 480 2016-10-12 09:36:41,062 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets 2016-10-12 09:36:41,062 [analyzer] DEBUG: Started auxiliary module Human 2016-10-12 09:36:41,062 [analyzer] DEBUG: Started auxiliary module InstallCertificate 2016-10-12 09:36:41,062 [analyzer] DEBUG: Started auxiliary module Reboot 2016-10-12 09:36:42,832 [analyzer] DEBUG: Started auxiliary module RecentFiles 2016-10-12 09:36:42,832 [analyzer] DEBUG: Started auxiliary module Screenshots 2016-10-12 09:36:44,138 [modules.auxiliary.human] INFO: Found button "OK", clicking it 2016-10-12 09:36:45,325 [lib.api.process] ERROR: Failed to execute process from path u'C:\\Users\\ALEXAN~1\\AppData\\Local\\Temp\\akomani.exe' with arguments ['bin\\inject-x86.exe', '--resume-thread', '--pid', '2328', '--tid', '544', '--apc', '--dll', 'C:\\lexfljo\\bin\\monitor-x86.dll', '--config', 'c:\\users\\alexan~1\\appdata\\local\\temp\\tmpnau7lq'] (Error: The operation completed successfully (ERROR_SUCCESS))

Could I have just messed up a part of my config files? Sorry if it's something really simple that I'm missing!

[doomedraven]

probably, because it works fine for me

[fez219]

@doomedraven So nothing jumps out as strange in my logs? I really want to figure out what's wrong. Like I said, pafish works perfectly. Also, free=yes does not fix my problem.

The error I get on the VM is this:

inject error:
[-] Error adding task to APC queue: 6

So I'm pretty sure it has to do with the actual .exe injection :p

[doomedraven]

the strange is this:

ERROR: Failed to execute process from path u'C:\\Users\\ALEXAN~1\\AppData\\Local\\Temp\\akomani.exe' with arguments ['bin\\inject-x86.exe', '--resume-thread', '--pid', '2328', '--tid', '544', '--apc', '--dll', 'C:\\lexfljo\\bin\\monitor-x86.dll', '--config', 'c:\\users\\alexan~1\\appdata\\local\\temp\\tmpnau7lq'] (Error: The operation completed successfully (ERROR_SUCCESS))

but on my side i dont' have that error

@jbremer any idea what can be wrong here?

[Prochainezo]

I can confirm that I am receiving the same errors as @fez219. Here are two screenshots of my agent.py displaying the errors discussed in this thread.

[fez219]

@Prochainezo did you have to make any changes to your system to receive these errors? Or is your environment causing the errors by default?

[Titotix]

@fez219 & @Prochainezo : Did you try to update community repo stuff ?
./utils/community.py -awf

[fez219]

@Titotix No luck.

@Prochainezo really curious to hear back from you on how you replicated my errors!

[jbremer]

@doomedraven If you get Error: The operation completed successfully (ERROR_SUCCESS) that means that you have a Cuckoo Monitor that's too recent for Cuckoo itself, unfortunately. There were some required updates that were not backwards compatible. Please upgrade Cuckoo.

[fez219]

@jbremer any ideas on what might be causing this error?

[-] Error adding task to APC queue:

[fez219]

@jbremer Also, the error only appears when I don't do the free=yes option. I'm wondering why that happens.

[jbremer]

Can you share some samples so that we can replicate?

[fez219]

@jbremer I have the sample that causes the error, how would you like me to share it with you? It's live malware, not just test files FYI.

[jbremer]

A hash that's present on virustotal would suffice. Or you can email it to me at [email protected].

[fez219]

@jbremer Here's the sample's hashes:

• MD5: bb72bed531d75dadb3587b2a1ec10da2
• SHA1: f450ebc7273d0dc1b6cebf9360ebcdbfec318d57
• SHA256: 5038e948fda799bc6b779c1c54d6a72c03a4e571615f7a5529eb5549dfb21da2

[fez219]

@jbremer Any progress on this?

[daniel-gallagher]

I have been struggling with this issue as well on the current code. I have been chasing my tail because I only started experiencing the error after adding VTi download capabilities to the submission page, so I felt I introduced the problem. Now I don't think that is the case.

From what I can tell, this occurs when trying to analyze a .NET sample. It just happened that I picked three .NET samples in a row on VT and they all crashed. The sample above that fez219 is having issues with is Samsam ransomware, which is also .NET. Hopefully that helps to guide diagnosis!

[sandipkirar]

I also have the above stated similar issue with .Net executable. I tried lots of combinations like changing monitor files with other old cuckoo version's, changing agent.py etc... But its of no use.
Finally i got some hint about problem statement.
When i use Windows-7, 32 bit vm then .Net executable working fine(cuckoo injected files successfully)
When i use Windows-7, 64 bit vm then .Net executable processing failed and cuckoo injection fails with "Error adding task to apc queue: 6" Error.
So dev's please look into issue.
Any help is appreciated....

[jbremer]

Thanks for the feedback! We'll have to do some proper testing for that then.

[wjlandryiii]

I was able to run the 5038e948fda799bc6b779c1c54d6a72c03a4e571615f7a5529eb5549dfb21da2 sample in a 64-bit VM by patching the "32-bit required" flag in the flags field of the .NET data directory.

The patched version is: a16f347c4c0e0b40e4e5c5af75f0ae1e413a0570310e08d4bb956f573aa592c6

I think this is a bug with the monitor.

[SparkyNZL]

thats a good find, i have the same issue with some .net exe files. Ill try
this and see if it fixes the issue

On Wed, Apr 26, 2017 at 7:00 AM, wjlandryiii [e-mail]
wrote:

I was able to run the 5038e948fda799bc6b779c1c54d6a7
2c03a4e571615f7a5529eb5549dfb21da2 sample in a 64-bit VM by patching the
"32-bit required" flag in the flags field of the .NET data directory.

The patched version is: a16f347c4c0e0b40e4e5c5af75f0ae
1e413a0570310e08d4bb956f573aa592c6

[image: image]
https://cloud.githubusercontent.com/assets/1929416/25402757/9e3ab574-29ae-11e7-9487-56c3d268d576.png

I think this is a bug with the monitor.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/cuckoosandbox/cuckoo/issues/1119#issuecomment-297132004,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AQ_imPf9E7g3KB6U6JMtiNBADtg_QwL6ks5rzkLigaJpZM4KMqaT
.

[wjlandryiii]

The sample runs correctly if the flag is set. Unlike the image I posted.

Just clarifying because my last post was a little ambiguous.

[wjlandryiii]

I've done some digging and this is what i've found

The problem

When is32bit.exe is given the -f option, it determines 32/64 bitness based on the Machine field of the NT header. On .NET binaries, this value is IMAGE_FILE_MACHINE_I386 but in a 64-bit vm, the process will run as a 64-bit process as long as the 32bit required flag isn't set in the .NET directory. The analyzer will then try run inject-x86.exe on a 64-bit process and fail with the [-] Error adding task to APC queue: 6 error.

My fix

I modified the Process.execute method to check for 32/64 bitness after the process is created, then inject the appropriate inject-x*.exe and dll.

https://github.com/cuckoosandbox/cuckoo/blob/2.0.1/cuckoo/data/analyzer/windows/lib/api/process.py#L214

A copy of my process.py file is located here: https://gist.github.com/wjlandryiii/ab2de0d528b13b1727845ac5cb537db1

by placing this file here: ~/.cuckoo/analyzer/windows/lib/api/process.py i was able to run the .NET binaries in a 64-bit vm.

I don't know if this is the solution the authors will want to use, but this works for me. Let me know if you want me to make a PR.

[FluffyAlpaca]

I had the same issue. As @wjlandryiii said, setting the flag "32bit required" on the executable resolved it for me. Thanks !

[jbremer]

@wjlandryiii sorry - didn't notice this thread earlier. Thanks for the suggestion @ 32-bit. Still working on resolving this issue, hopefully soon'ish.

[daanfs]

With a .NET sample for the AnyCPU target on a 64-bit VM, a 32-bit PE file will spawn a 64-bit process.
We could fix this inside the determine_pe_file function inside monitor (by checking if the target is AnyCPU and then using the system bitness), but since the file is technically a 32-bit file and the eventual bitness of the process can also depend on other factors, I think the simplest and cleanest solution is indeed to recheck the process bitness after startup. This is also how cuckoo-modified does it.

See https://github.com/cuckoosandbox/cuckoo/pull/1947. The original sample works with this fix.

[jbremer]

Thanks all, @daanfs pushed a fix in #1947 (thanks also @wjlandryiii for providing the solution earlier - lost track of it). This fix will be pushed as part of our upcoming 2.0.5a1 release. Closing issue once that's been pushed.

[jbremer]

This has been resolved in our 2.0.5 release which we put out just now. Please upgrade and try again! Closing issue, but feel free to reopen if the issue(s) persist for you. Thanks!
Please find also our blogpost https://cuckoosandbox.org/blog/205-office-dde