Size | 6.4KB |
---|---|
Type | Unicode text, UTF-8 text, with very long lines (700), with CRLF line terminators |
MD5 | df02b85b07a6701436b40632d7623ca9 |
SHA1 | 80c24533efeaffb5dc8c34fd1ff76ddc8d6a8854 |
SHA256 | 588d4e72778aa0a48269470a289a79cce3625bb184d0d3db12be478911071237 |
SHA512 |
f7820a54514bae5e82b7e2d4b96bfb7c64984b08def901f166ce8777e889db32ebfb893919f63ca747b146728ca3ee2298c1abe98ec316cfe3eef379bdcce3b3
|
CRC32 | 7630DC33 |
ssdeep | None |
Yara | None matched |
Please notice: The scoring system is currently still in development and should be considered an alpha feature.
Expecting different results? Send us this analysis and we will inspect it. Click here
Category | Started | Completed | Duration | Routing | Logs |
---|---|---|---|---|---|
FILE | May 5, 2025, 6:45 a.m. | May 5, 2025, 6:52 a.m. | 427 seconds | internet |
Show Analyzer Log Show Cuckoo Log |
2025-05-01 10:00:56,015 [analyzer] DEBUG: Starting analyzer from: C:\tmppw5mq4 2025-05-01 10:00:56,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\TvwOXaYTGJVmZSvEK 2025-05-01 10:00:56,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\YHKjKAhxoaXQGDLybeMclwsOR 2025-05-01 10:00:56,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically. 2025-05-01 10:00:56,015 [analyzer] INFO: Automatically selected analysis package "generic" 2025-05-01 10:00:56,265 [analyzer] DEBUG: Started auxiliary module Curtain 2025-05-01 10:00:56,265 [analyzer] DEBUG: Started auxiliary module DbgView 2025-05-01 10:00:56,733 [analyzer] DEBUG: Started auxiliary module Disguise 2025-05-01 10:00:56,921 [analyzer] DEBUG: Loaded monitor into process with pid 504 2025-05-01 10:00:56,921 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets 2025-05-01 10:00:56,921 [analyzer] DEBUG: Started auxiliary module Human 2025-05-01 10:00:56,921 [analyzer] DEBUG: Started auxiliary module InstallCertificate 2025-05-01 10:00:56,921 [analyzer] DEBUG: Started auxiliary module Reboot 2025-05-01 10:00:57,000 [analyzer] DEBUG: Started auxiliary module RecentFiles 2025-05-01 10:00:57,000 [analyzer] DEBUG: Started auxiliary module Screenshots 2025-05-01 10:00:57,000 [analyzer] DEBUG: Started auxiliary module Sysmon 2025-05-01 10:00:57,015 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n 2025-05-01 10:00:57,092 [lib.api.process] INFO: Successfully executed process from path 'C:\\Windows\\System32\\cmd.exe' with arguments ['/c', 'start', '/wait', '"ooIMFyCdInVwfxHP"', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\hRImJhCnDsdI.swf'] and pid 2756 2025-05-01 10:00:57,375 [analyzer] DEBUG: Loaded monitor into process with pid 2756 2025-05-01 10:00:57,765 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-05-01 10:00:57,812 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,828 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,828 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,828 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-05-01 10:00:57,842 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,842 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,858 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,858 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,905 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,921 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-05-01 10:00:57,967 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-05-01 10:00:57,967 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,967 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,967 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,983 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-05-01 10:00:57,983 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,983 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,983 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:57,983 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,015 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,015 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-05-01 10:00:58,530 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-05-01 10:00:58,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,546 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-05-01 10:00:58,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,562 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,562 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,562 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,562 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-05-01 10:00:58,687 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-05-01 10:00:58,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,703 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-05-01 10:00:58,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-05-01 10:00:58,717 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-05-01 10:01:03,592 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService. 2025-05-01 10:01:03,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,592 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA. 2025-05-01 10:01:03,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,592 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,608 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)! 2025-05-01 10:01:03,608 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW. 2025-05-01 10:01:26,125 [analyzer] INFO: Analysis timeout hit, terminating analysis. 2025-05-01 10:01:26,546 [analyzer] INFO: Terminating remaining processes before shutdown. 2025-05-01 10:01:26,546 [lib.api.process] INFO: Successfully terminated process with pid 2756. 2025-05-01 10:01:26,546 [analyzer] INFO: Analysis completed.
2025-05-05 06:45:44,157 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:45,323 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:46,407 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:47,487 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:48,570 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:50,069 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:51,140 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:52,229 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:53,282 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:54,338 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:55,398 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:56,476 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:57,545 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:58,607 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:45:59,666 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:00,735 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:01,797 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:02,867 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:03,943 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:05,023 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:06,163 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:07,245 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:08,304 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:09,336 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:10,366 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:11,398 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:12,420 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:13,440 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:14,459 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:15,477 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:16,559 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:17,582 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:18,601 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:19,622 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:20,648 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:21,677 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:22,704 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:23,729 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:24,758 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:25,798 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:26,906 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:27,929 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:28,956 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:29,986 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:31,108 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:32,136 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:33,169 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:34,274 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:35,323 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:36,347 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:37,373 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:38,403 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:39,428 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:40,559 [cuckoo.core.scheduler] DEBUG: Task #6393061: no machine available yet 2025-05-05 06:46:41,593 [cuckoo.core.scheduler] INFO: Task #6393061: acquired machine win7x646 (label=win7x646) 2025-05-05 06:46:41,594 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.206 for task #6393061 2025-05-05 06:46:41,842 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2624635 (interface=vboxnet0, host=192.168.168.206) 2025-05-05 06:46:41,910 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x646 2025-05-05 06:46:42,368 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x646 to vmcloak 2025-05-05 06:49:30,972 [cuckoo.core.guest] INFO: Starting analysis #6393061 on guest (id=win7x646, ip=192.168.168.206) 2025-05-05 06:49:32,066 [cuckoo.core.guest] DEBUG: win7x646: not ready yet 2025-05-05 06:49:37,119 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x646, ip=192.168.168.206) 2025-05-05 06:49:37,195 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x646, ip=192.168.168.206, monitor=latest, size=6660546) 2025-05-05 06:49:38,400 [cuckoo.core.resultserver] DEBUG: Task #6393061: live log analysis.log initialized. 2025-05-05 06:49:39,349 [cuckoo.core.resultserver] DEBUG: Task #6393061 is sending a BSON stream 2025-05-05 06:49:39,642 [cuckoo.core.resultserver] DEBUG: Task #6393061 is sending a BSON stream 2025-05-05 06:49:40,532 [cuckoo.core.resultserver] DEBUG: Task #6393061: File upload for 'shots/0001.jpg' 2025-05-05 06:49:40,548 [cuckoo.core.resultserver] DEBUG: Task #6393061 uploaded file length: 110743 2025-05-05 06:49:46,863 [cuckoo.core.resultserver] DEBUG: Task #6393061: File upload for 'shots/0002.jpg' 2025-05-05 06:49:46,895 [cuckoo.core.resultserver] DEBUG: Task #6393061 uploaded file length: 116037 2025-05-05 06:49:48,080 [cuckoo.core.resultserver] DEBUG: Task #6393061: File upload for 'shots/0003.jpg' 2025-05-05 06:49:48,111 [cuckoo.core.resultserver] DEBUG: Task #6393061 uploaded file length: 120949 2025-05-05 06:49:53,118 [cuckoo.core.guest] DEBUG: win7x646: analysis #6393061 still processing 2025-05-05 06:50:08,208 [cuckoo.core.guest] DEBUG: win7x646: analysis #6393061 still processing 2025-05-05 06:50:08,729 [cuckoo.core.resultserver] DEBUG: Task #6393061: File upload for 'curtain/1746086486.31.curtain.log' 2025-05-05 06:50:08,732 [cuckoo.core.resultserver] DEBUG: Task #6393061 uploaded file length: 36 2025-05-05 06:50:08,932 [cuckoo.core.resultserver] DEBUG: Task #6393061: File upload for 'sysmon/1746086486.52.sysmon.xml' 2025-05-05 06:50:08,961 [cuckoo.core.resultserver] DEBUG: Task #6393061 uploaded file length: 2039876 2025-05-05 06:50:09,716 [cuckoo.core.resultserver] DEBUG: Task #6393061: File upload for 'shots/0004.jpg' 2025-05-05 06:50:09,730 [cuckoo.core.resultserver] DEBUG: Task #6393061 uploaded file length: 133474 2025-05-05 06:50:09,742 [cuckoo.core.resultserver] DEBUG: Task #6393061 had connection reset for <Context for LOG> 2025-05-05 06:50:11,225 [cuckoo.core.guest] INFO: win7x646: analysis completed successfully 2025-05-05 06:50:11,237 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks 2025-05-05 06:50:11,267 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2025-05-05 06:50:11,942 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x646 to path /srv/cuckoo/cwd/storage/analyses/6393061/memory.dmp 2025-05-05 06:50:11,943 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x646 2025-05-05 06:52:49,427 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.206 for task #6393061 2025-05-05 06:52:50,537 [cuckoo.core.scheduler] DEBUG: Released database task #6393061 2025-05-05 06:52:50,578 [cuckoo.core.scheduler] INFO: Task #6393061: analysis procedure completed
No signatures