Cuckoo: Analysis caught an exception

[shafaqat1]

My issue is:

I cloned the GitHub repo and build the cuckoo from the source code with the commands python stuff/monitor.py and python setup.py build
Then I installed the cuckoo with python setup.py install. After successfully installing, when cuckoo analyzes an infected file, it always catches an exception in the infected file.

My Cuckoo version and operating system are:

Cuckoo: 2.0.5.3
Virtualbox: 5.2.6 r120293
Host OS: Ubuntu-16.04.1
Agent: 0.8
Guest OS: Win7 64B

The log, error, files etc:

After cuckoo analyzes the infected file, following logs are generated

```
2018-03-01 12:21:01,976 [cuckoo.core.scheduler] INFO: Task #5: acquired machine windows7 (label=windows7)
2018-03-01 12:21:02,000 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 15533 (interface=vboxnet0, host=192.168.56.101)
2018-03-01 12:21:02,002 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer
2018-03-01 12:21:02,143 [cuckoo.machinery.virtualbox] DEBUG: Starting vm windows7
2018-03-01 12:21:02,349 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine windows7 to Snapshot1
2018-03-01 12:21:18,256 [cuckoo.core.guest] INFO: Starting analysis on guest (id=windows7, ip=192.168.56.101)
2018-03-01 12:21:19,491 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.8 (id=windows7, ip=192.168.56.101)
2018-03-01 12:21:20,680 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=windows7, ip=192.168.56.101, monitor=latest, size=3841820)
2018-03-01 12:21:25,797 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:26,830 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:27,863 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:28,900 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:29,927 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:30,953 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:31,962 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:32,989 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:34,006 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:35,019 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.
2018-03-01 12:21:35,032 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:36,055 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:37,064 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:38,126 [cuckoo.core.guest] DEBUG: windows7: analysis still processing
2018-03-01 12:21:39,215 [cuckoo.core.guest] WARNING: windows7: analysis caught an exception
Traceback (most recent call last):
File "C:/tmpdy1cwr/analyzer.py", line 800, in
success = analyzer.run()
File "C:/tmpdy1cwr/analyzer.py", line 645, in run
zer0m0n.hidepid(self.ppid)
File "C:\tmpdy1cwr\lib\core\ioctl.py", line 99, in hidepid
return self.invoke("hidepid", struct.pack("I", pid))
error: cannot convert argument to integer

2018-03-01 12:21:39,393 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2018-03-01 12:21:59,532 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label windows7 to path /home/rana/.cuckoo/storage/analyses/5/memory.dmp
2018-03-01 12:21:59,559 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm windows7
2018-03-01 12:22:10,062 [cuckoo.core.scheduler] DEBUG: Released database task #5
2018-03-01 12:22:10,364 [cuckoo.core.plugins] DEBUG: Executed processing module "AnalysisInfo" for task #5
2018-03-01 12:22:10,365 [cuckoo.processing.behavior] WARNING: Analysis results folder does not contain any behavior log files.
2018-03-01 12:22:10,367 [cuckoo.core.plugins] DEBUG: Executed processing module "BehaviorAnalysis" for task #5
2018-03-01 12:22:10,368 [cuckoo.core.plugins] DEBUG: Executed processing module "Dropped" for task #5
2018-03-01 12:22:10,370 [cuckoo.core.plugins] DEBUG: Executed processing module "DroppedBuffer" for task #5
2018-03-01 12:22:18,137 [cuckoo.processing.memory] DEBUG: Executing volatility 'pslist' module.
2018-03-01 12:22:26,688 [cuckoo.processing.memory] DEBUG: Executing volatility 'psxview' module.
2018-03-01 12:22:53,731 [cuckoo.processing.memory] DEBUG: Executing volatility 'callbacks' module.
2018-03-01 12:23:04,561 [cuckoo.processing.memory] DEBUG: Executing volatility 'ssdt' module.
2018-03-01 12:23:08,187 [cuckoo.processing.memory] DEBUG: Executing volatility 'timers' module.
2018-03-01 12:23:10,365 [cuckoo.processing.memory] DEBUG: Skipping 'messagehooks' volatility module
2018-03-01 12:23:10,365 [cuckoo.processing.memory] DEBUG: Executing volatility 'getsids' module.
2018-03-01 12:23:12,440 [cuckoo.processing.memory] DEBUG: Executing volatility 'privs' module.
2018-03-01 12:23:14,624 [cuckoo.processing.memory] DEBUG: Executing volatility 'malfind' module.
2018-03-01 12:23:23,583 [cuckoo.processing.memory] DEBUG: Skipping 'apihooks' volatility module
2018-03-01 12:23:23,583 [cuckoo.processing.memory] DEBUG: Executing volatility 'dlllist' module.
2018-03-01 12:23:26,926 [cuckoo.processing.memory] DEBUG: Executing volatility 'handles' module.
2018-03-01 12:24:08,414 [cuckoo.processing.memory] DEBUG: Executing volatility 'ldrmodules' module.
2018-03-01 12:24:41,645 [cuckoo.processing.memory] DEBUG: Executing volatility 'mutantscan' module.
2018-03-01 12:24:45,814 [cuckoo.processing.memory] DEBUG: Executing volatility 'devicetree' module.
2018-03-01 12:24:48,757 [cuckoo.processing.memory] DEBUG: Executing volatility 'svcscan' module.
2018-03-01 12:24:51,252 [cuckoo.processing.memory] DEBUG: Executing volatility 'modscan' module.
2018-03-01 12:24:53,334 [cuckoo.processing.memory] DEBUG: Executing volatility 'yarascan' module.
2018-03-01 12:25:46,405 [cuckoo.processing.memory] DEBUG: Executing volatility 'netscan' module.
2018-03-01 12:25:53,444 [cuckoo.core.plugins] DEBUG: Executed processing module "Memory" for task #5
2018-03-01 12:25:53,543 [cuckoo.core.plugins] DEBUG: Executed processing module "MetaInfo" for task #5
2018-03-01 12:25:53,544 [cuckoo.core.plugins] DEBUG: Executed processing module "ProcessMemory" for task #5
2018-03-01 12:25:53,545 [cuckoo.core.plugins] DEBUG: Executed processing module "Procmon" for task #5
2018-03-01 12:25:53,559 [cuckoo.core.plugins] DEBUG: Executed processing module "Screenshots" for task #5
2018-03-01 12:25:54,730 [cuckoo.core.plugins] DEBUG: Executed processing module "Static" for task #5
2018-03-01 12:25:54,860 [cuckoo.core.plugins] DEBUG: Executed processing module "Strings" for task #5
2018-03-01 12:25:55,122 [cuckoo.core.plugins] DEBUG: Executed processing module "TargetInfo" for task #5
2018-03-01 12:25:55,721 [cuckoo.core.plugins] DEBUG: Executed processing module "NetworkAnalysis" for task #5
2018-03-01 12:25:55,722 [cuckoo.core.plugins] DEBUG: Executed processing module "Extracted" for task #5
2018-03-01 12:25:55,722 [cuckoo.core.plugins] DEBUG: Executed processing module "TLSMasterSecrets" for task #5
2018-03-01 12:25:55,755 [cuckoo.core.plugins] DEBUG: Executed processing module "Debug" for task #5
2018-03-01 12:25:55,760 [cuckoo.core.plugins] DEBUG: Running 473 signatures
2018-03-01 12:25:55,900 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_handles_1
2018-03-01 12:25:55,962 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_ldrmodules_1
2018-03-01 12:25:55,963 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_malfind_2
2018-03-01 12:25:55,973 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_svcscan_1
2018-03-01 12:25:55,974 [cuckoo.core.plugins] DEBUG: Analysis matched signature: volatility_svcscan_3
2018-03-01 12:25:56,637 [cuckoo.core.plugins] DEBUG: Executed reporting module "JsonDump"

[johnc2k]

I've also got this issue, same setup as above but using VMware instead of VBox.

Reverting this commit https://github.com/cuckoosandbox/cuckoo/commit/92d0f5157ed335c941425e433515abaaa9573495 resolves the problem for me.

[tosto92]

I have the same issue on a W10 64B Guest (but not on my W7 64B)
I've added a try/catch on the hide ppid (line 645) buth I found a second issue on the "is32bit" check

Traceback (most recent call last):
  File "C:/tmpczhham/analyzer.py", line 805, in <module>
    success = analyzer.run()
  File "C:/tmpczhham/analyzer.py", line 657, in run
    pids = self.package.start(self.target)
  File "C:\tmpczhham\modules\packages\exe.py", line 23, in start
    return self.execute(path, args=shlex.split(args))
  File "C:\tmpczhham\lib\common\abstracts.py", line 164, in execute
    maximize=maximize, env=env, trigger=trigger):
  File "C:\tmpczhham\lib\api\process.py", line 296, in execute
    is32bit = self.is32bit(path=path)
  File "C:\tmpczhham\lib\api\process.py", line 267, in is32bit
    bitsize = int(subprocess_checkoutput(args))
ValueError: invalid literal for int() with base 10: ''

maybe the problem is somewhere else...after a little debugging I've found that I have None in the _ppid_ variable in the _Analyzer_ instance.

[jbremer]

Thanks everyone! We've fixed the error: cannot convert argument to integer error. Will be pushing this shortly and also do an interim release soon, more on that later!
The ValueError: invalid literal for int() with base 10: '' error is somewhat related to this BTW, so that has also been resolved now!

[tosto92]

I can confirm that (at least in my case) the update solved the issue!

Thank you!

[RicoVZ]

Good to hear @tosto92, thanks for confirming! :smile:

[jbremer]

This is part of our 2.0.6 release, closing as resolved. Thanks!