Summary

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:5160245

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

2024-08-31 18:19:29,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpblqbwr
2024-08-31 18:19:29,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\XDMNxcQGofQQyORpVCbQrkgFoOGEVt
2024-08-31 18:19:29,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\uaeRPZfSRifTaxrqEmNGSts
2024-08-31 18:19:29,030 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2024-08-31 18:19:29,030 [analyzer] INFO: Automatically selected analysis package "generic"
2024-08-31 18:19:29,265 [analyzer] DEBUG: Started auxiliary module Curtain
2024-08-31 18:19:29,265 [analyzer] DEBUG: Started auxiliary module DbgView
2024-08-31 18:19:29,687 [analyzer] DEBUG: Started auxiliary module Disguise
2024-08-31 18:19:29,875 [analyzer] DEBUG: Loaded monitor into process with pid 504
2024-08-31 18:19:29,875 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2024-08-31 18:19:29,875 [analyzer] DEBUG: Started auxiliary module Human
2024-08-31 18:19:29,875 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2024-08-31 18:19:29,875 [analyzer] DEBUG: Started auxiliary module Reboot
2024-08-31 18:19:29,983 [analyzer] DEBUG: Started auxiliary module RecentFiles
2024-08-31 18:19:29,983 [analyzer] DEBUG: Started auxiliary module Screenshots
2024-08-31 18:19:29,983 [analyzer] DEBUG: Started auxiliary module Sysmon
2024-08-31 18:19:29,983 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2024-08-31 18:19:30,078 [lib.api.process] INFO: Successfully executed process from path 'C:\\Windows\\System32\\cmd.exe' with arguments ['/c', 'start', '/wait', '"AWKYJprQwnv"', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\13756acb877074ab_setup.ini'] and pid 2408
2024-08-31 18:19:30,390 [analyzer] DEBUG: Loaded monitor into process with pid 2408
2024-08-31 18:19:30,812 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,842 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,858 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,858 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,858 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,858 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,875 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,875 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,875 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,905 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,905 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,937 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,953 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,953 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,953 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,953 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,953 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,967 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,967 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,967 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,967 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:30,983 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,421 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,421 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,421 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,437 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,437 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,437 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,437 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,453 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,453 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,453 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,467 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,578 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,578 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,592 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,592 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,592 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,592 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,608 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,608 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,625 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,625 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:31,625 [analyzer] CRITICAL: Unable to find closeby page for hooking!
2024-08-31 18:19:37,390 [analyzer] INFO: Injected into process with pid 2096 and name u'notepad.exe'
2024-08-31 18:19:37,608 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 2096.
2024-08-31 18:19:37,812 [analyzer] DEBUG: Loaded monitor into process with pid 2096
2024-08-31 17:23:29,546 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2024-08-31 17:23:30,015 [analyzer] INFO: Terminating remaining processes before shutdown.
2024-08-31 17:23:30,015 [lib.api.process] INFO: Successfully terminated process with pid 2408.
2024-08-31 17:23:30,015 [lib.api.process] INFO: Successfully terminated process with pid 2096.
2024-08-31 17:23:30,015 [analyzer] INFO: Analysis completed.

2024-08-31 18:19:48,193 [cuckoo.core.scheduler] INFO: Task #5160253: acquired machine win7x6418 (label=win7x6418)
2024-08-31 18:19:48,193 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.218 for task #5160253
2024-08-31 18:19:48,936 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1364827 (interface=vboxnet0, host=192.168.168.218)
2024-08-31 18:19:49,246 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6418
2024-08-31 18:19:50,484 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6418 to vmcloak
2024-08-31 18:20:01,833 [cuckoo.core.guest] INFO: Starting analysis #5160253 on guest (id=win7x6418, ip=192.168.168.218)
2024-08-31 18:20:02,838 [cuckoo.core.guest] DEBUG: win7x6418: not ready yet
2024-08-31 18:20:08,087 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6418, ip=192.168.168.218)
2024-08-31 18:20:08,183 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6418, ip=192.168.168.218, monitor=latest, size=6660546)
2024-08-31 18:20:09,424 [cuckoo.core.resultserver] DEBUG: Task #5160253: live log analysis.log initialized.
2024-08-31 18:20:10,259 [cuckoo.core.resultserver] DEBUG: Task #5160253 is sending a BSON stream
2024-08-31 18:20:10,665 [cuckoo.core.resultserver] DEBUG: Task #5160253 is sending a BSON stream
2024-08-31 18:20:11,536 [cuckoo.core.resultserver] DEBUG: Task #5160253: File upload for 'shots/0001.jpg'
2024-08-31 18:20:11,549 [cuckoo.core.resultserver] DEBUG: Task #5160253 uploaded file length: 110748
2024-08-31 18:20:18,134 [cuckoo.core.resultserver] DEBUG: Task #5160253 is sending a BSON stream
2024-08-31 18:20:18,835 [cuckoo.core.resultserver] DEBUG: Task #5160253: File upload for 'shots/0002.jpg'
2024-08-31 18:20:18,850 [cuckoo.core.resultserver] DEBUG: Task #5160253 uploaded file length: 85956
2024-08-31 18:20:19,967 [cuckoo.core.resultserver] DEBUG: Task #5160253: File upload for 'shots/0003.jpg'
2024-08-31 18:20:19,984 [cuckoo.core.resultserver] DEBUG: Task #5160253 uploaded file length: 133535
2024-08-31 18:20:24,070 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:20:39,157 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:20:54,234 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:21:09,312 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:21:24,387 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:21:39,464 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:21:54,539 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:22:09,623 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:22:24,712 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:22:39,790 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:22:54,871 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:23:10,001 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:23:25,371 [cuckoo.core.guest] DEBUG: win7x6418: analysis #5160253 still processing
2024-08-31 18:23:29,816 [cuckoo.core.resultserver] DEBUG: Task #5160253: File upload for 'curtain/1725117809.81.curtain.log'
2024-08-31 18:23:29,819 [cuckoo.core.resultserver] DEBUG: Task #5160253 uploaded file length: 36
2024-08-31 18:23:30,004 [cuckoo.core.resultserver] DEBUG: Task #5160253: File upload for 'sysmon/1725117810.0.sysmon.xml'
2024-08-31 18:23:30,020 [cuckoo.core.resultserver] DEBUG: Task #5160253 uploaded file length: 600164
2024-08-31 18:23:30,799 [cuckoo.core.resultserver] DEBUG: Task #5160253: File upload for 'shots/0004.jpg'
2024-08-31 18:23:30,824 [cuckoo.core.resultserver] DEBUG: Task #5160253 uploaded file length: 133473
2024-08-31 18:23:30,842 [cuckoo.core.resultserver] DEBUG: Task #5160253 had connection reset for <Context for LOG>
2024-08-31 18:23:31,397 [cuckoo.core.guest] INFO: win7x6418: analysis completed successfully
2024-08-31 18:23:31,412 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2024-08-31 18:23:31,435 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2024-08-31 18:23:33,511 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6418 to path /srv/cuckoo/cwd/storage/analyses/5160253/memory.dmp
2024-08-31 18:23:33,512 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6418
2024-08-31 18:23:43,113 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.218 for task #5160253
2024-08-31 18:23:43,396 [cuckoo.core.scheduler] DEBUG: Released database task #5160253
2024-08-31 18:23:43,421 [cuckoo.core.scheduler] INFO: Task #5160253: analysis procedure completed