Cuckoo: Analyzer doesn't work. Stopped at Started auxiliary module disguise

[ahroobe]

Hi, I'm trying to use cuckoo sandbox to analyze malware, but got a problem.

Host OS is Ubuntu with VMware and guest OS is windowsXP with VirtualBox.

I just followed every steps in cuckoo manual.
Also, I checked any network communication environment by using curl, ping.
If i use curl, I got proper answer from virtual box.
$ curl 192.168.56.101:8000
{"message": "Cuckoo Agent!", "version": "0.7", "features": ["execpy", "pinning", "logs", "largefile", "unicodepath"]}

However, Log just stopped in module disguise and nothing is analyzed. (static and dynamic)

Here is my log in Analyzer

2017-05-19 05:17:31,200 [analyzer] DEBUG: Starting analyzer from: C:\tmpkykjuf
2017-05-19 05:17:31,200 [analyzer] DEBUG: Pipe server name: \??\PIPE\kvSPfVeSKJgmugCqLvWvEtMEADxda
2017-05-19 05:17:31,200 [analyzer] DEBUG: Log pipe server name: \??\PIPE\OxOUXgZtsMsyzsjMChkduBAxwcu
2017-05-19 05:17:31,210 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2017-05-19 05:17:31,380 [analyzer] INFO: Automatically selected analysis package "exe"
2017-05-19 05:17:33,773 [analyzer] DEBUG: Started auxiliary module DbgView
2017-05-19 21:17:59,417 [analyzer] DEBUG: Started auxiliary module Disguise

and Cuckoo Log

2017-05-19 05:17:30,750 [cuckoo.core.scheduler] INFO: Task #21: acquired machine cuckoo2 (label=cuckoo2)
2017-05-19 05:17:30,769 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 33994 (interface=vboxnet0, host=192.168.56.101, pcap=/home/ahroobe/.cuckoo/storage/analyses/21/dump.pcap)
2017-05-19 05:17:30,770 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer
2017-05-19 05:17:30,995 [cuckoo.machinery.virtualbox] DEBUG: Starting vm cuckoo2
2017-05-19 05:17:31,138 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine cuckoo2 to ana
2017-05-19 05:17:33,913 [cuckoo.core.guest] INFO: Starting analysis on guest (id=cuckoo2, ip=192.168.56.101)
2017-05-19 05:17:34,927 [cuckoo.core.guest] DEBUG: cuckoo2: not ready yet
2017-05-19 05:17:35,934 [cuckoo.core.guest] DEBUG: cuckoo2: not ready yet
2017-05-19 05:17:36,938 [cuckoo.core.guest] DEBUG: cuckoo2: not ready yet
2017-05-19 05:17:36,975 [cuckoo.core.guest] DEBUG: cuckoo2: not ready yet
2017-05-19 05:17:38,980 [cuckoo.core.guest] DEBUG: cuckoo2: not ready yet
2017-05-19 05:17:39,164 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.7 (id=cuckoo2, ip=192.168.56.101)
2017-05-19 05:17:39,328 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=cuckoo2, ip=192.168.56.101, monitor=latest, size=1770809)
2017-05-19 05:17:42,425 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:43,535 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:44,606 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:45,452 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.
2017-05-19 05:17:45,614 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:46,636 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:47,646 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:48,682 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:49,770 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:50,777 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:51,790 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:17:52,800 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
...
2017-05-19 05:20:41,465 [cuckoo.core.guest] DEBUG: cuckoo2: analysis still processing
2017-05-19 05:20:42,466 [cuckoo.core.scheduler] ERROR: Error from the Cuckoo Guest: The analysis hit the critical timeout, terminating.
2017-05-19 05:20:42,499 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2017-05-19 05:20:45,338 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label cuckoo2 to path /home/ahroobe/.cuckoo/storage/analyses/21/memory.dmp
2017-05-19 05:20:45,347 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm cuckoo2
2017-05-19 05:20:47,602 [cuckoo.core.scheduler] DEBUG: Released database task #21
2017-05-19 05:20:47,675 [cuckoo.core.plugins] DEBUG: Executed processing module "AnalysisInfo" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:47,675 [cuckoo.processing.behavior] WARNING: Analysis results folder does not contain any behavior log files.
2017-05-19 05:20:47,676 [cuckoo.core.plugins] DEBUG: Executed processing module "BehaviorAnalysis" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:47,676 [cuckoo.core.plugins] DEBUG: Executed processing module "Dropped" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:47,676 [cuckoo.core.plugins] DEBUG: Executed processing module "DroppedBuffer" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:47,687 [cuckoo.core.plugins] DEBUG: Executed processing module "MetaInfo" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:47,688 [cuckoo.core.plugins] DEBUG: Executed processing module "ProcessMemory" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:47,688 [cuckoo.core.plugins] DEBUG: Executed processing module "Procmon" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:47,688 [cuckoo.core.plugins] DEBUG: Executed processing module "Screenshots" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:48,652 [cuckoo.core.plugins] DEBUG: Executed processing module "Static" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:48,773 [cuckoo.core.plugins] DEBUG: Executed processing module "Strings" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:48,810 [cuckoo.core.plugins] DEBUG: Executed processing module "TargetInfo" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:48,878 [cuckoo.core.plugins] DEBUG: Executed processing module "NetworkAnalysis" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:48,879 [cuckoo.core.plugins] DEBUG: Executed processing module "TLSMasterSecrets" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:48,891 [cuckoo.core.plugins] DEBUG: Executed processing module "Debug" on analysis at "/home/ahroobe/.cuckoo/storage/analyses/21"
2017-05-19 05:20:48,891 [cuckoo.core.plugins] DEBUG: Running 0 signatures
2017-05-19 05:20:48,931 [cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump"

What is the problem in my system?

[jbremer]

There were some issues with Windows XP earlier. I'm literally about to release a new version, 2.0.3, which (among other stuff) also fixes that issue. Please wait a little bit :)

[jbremer]

Ok, just released the new version. Please upgrade with pip install -U cuckoo. That should resolve your issues, but please let us know if that's the case.

[ahroobe]

I upgraded to version 2.0.3 right before, but still not working..... anything else i have to do?
should change guest OS?

[jbremer]

Hm, oke. I'm going to have to do more debugging then, which is going to take a couple of days at least (quite busy at the moment). Sorry for the delay.

[jbremer]

I believe this should be fixed. Going to close the issue as nobody replied to it in almost a year. Please reopen if you find this issue still persists.