Summary

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6635953

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

2025-06-26 19:57:39,015 [analyzer] DEBUG: Starting analyzer from: C:\tmptpreht
2025-06-26 19:57:39,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\wpsXIyxfbGkJMGpzF
2025-06-26 19:57:39,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\csDsMcPYNHecJihef
2025-06-26 19:57:39,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-06-26 19:57:39,030 [analyzer] INFO: Automatically selected analysis package "generic"
2025-06-26 19:57:39,405 [analyzer] DEBUG: Started auxiliary module Curtain
2025-06-26 19:57:39,405 [analyzer] DEBUG: Started auxiliary module DbgView
2025-06-26 19:57:39,967 [analyzer] DEBUG: Started auxiliary module Disguise
2025-06-26 19:57:40,171 [analyzer] DEBUG: Loaded monitor into process with pid 500
2025-06-26 19:57:40,171 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-06-26 19:57:40,171 [analyzer] DEBUG: Started auxiliary module Human
2025-06-26 19:57:40,171 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-06-26 19:57:40,187 [analyzer] DEBUG: Started auxiliary module Reboot
2025-06-26 19:57:40,233 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-06-26 19:57:40,233 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-06-26 19:57:40,233 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-06-26 19:57:40,233 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-06-26 19:57:40,358 [lib.api.process] INFO: Successfully executed process from path 'C:\\Windows\\System32\\cmd.exe' with arguments ['/c', 'start', '/wait', '"fMiSGHIdXNFW"', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\c04d17ccc7c8c0d4_config.ini'] and pid 1784
2025-06-26 19:57:40,671 [analyzer] DEBUG: Loaded monitor into process with pid 1784
2025-06-26 19:57:41,030 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService.
2025-06-26 19:57:41,062 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,078 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,078 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA.
2025-06-26 19:57:41,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,092 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,108 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,140 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,155 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW.
2025-06-26 19:57:41,187 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService.
2025-06-26 19:57:41,187 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,203 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA.
2025-06-26 19:57:41,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,203 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,217 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,217 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,217 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW.
2025-06-26 19:57:41,765 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService.
2025-06-26 19:57:41,765 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,780 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,780 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,780 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA.
2025-06-26 19:57:41,780 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,780 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,796 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,796 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,796 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,796 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW.
2025-06-26 19:57:41,921 [analyzer] CRITICAL: Error creating function stub for advapi32!ControlService.
2025-06-26 19:57:41,921 [analyzer] CRITICAL: Unable to change memory protection of advapi32!DeleteService at 0x09f498 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,937 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,937 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,937 [analyzer] CRITICAL: Error creating function stub for advapi32!OpenServiceA.
2025-06-26 19:57:41,953 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,953 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 5 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,953 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,953 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 10 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,967 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 6 to RWX (error code 0xc0000045)!
2025-06-26 19:57:41,967 [analyzer] CRITICAL: Error creating function stub for advapi32!StartServiceW.
2025-06-26 19:57:49,937 [analyzer] INFO: Injected into process with pid 2504 and name u'notepad.exe'
2025-06-26 19:57:50,171 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 2504.
2025-06-26 19:57:50,437 [analyzer] DEBUG: Loaded monitor into process with pid 2504
2025-06-26 20:00:59,405 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-06-26 20:01:00,953 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-06-26 20:01:00,953 [lib.api.process] INFO: Successfully terminated process with pid 1784.
2025-06-26 20:01:00,953 [lib.api.process] INFO: Successfully terminated process with pid 2504.
2025-06-26 20:01:00,953 [analyzer] INFO: Analysis completed.

2025-07-03 01:22:30,860 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:31,885 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:32,912 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:33,934 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:34,999 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:36,133 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:37,162 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:38,187 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:39,213 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:40,237 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:41,265 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:42,340 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:43,367 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:44,397 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:45,439 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:46,470 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:47,510 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:48,546 [cuckoo.core.scheduler] DEBUG: Task #6635959: no machine available yet
2025-07-03 01:22:49,589 [cuckoo.core.scheduler] INFO: Task #6635959: acquired machine win7x641 (label=win7x641)
2025-07-03 01:22:49,590 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.201 for task #6635959
2025-07-03 01:22:50,031 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3883597 (interface=vboxnet0, host=192.168.168.201)
2025-07-03 01:22:50,070 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x641
2025-07-03 01:22:50,641 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x641 to vmcloak
2025-07-03 01:25:05,088 [cuckoo.core.guest] INFO: Starting analysis #6635959 on guest (id=win7x641, ip=192.168.168.201)
2025-07-03 01:25:06,119 [cuckoo.core.guest] DEBUG: win7x641: not ready yet
2025-07-03 01:25:11,361 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x641, ip=192.168.168.201)
2025-07-03 01:25:11,740 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x641, ip=192.168.168.201, monitor=latest, size=6660546)
2025-07-03 01:25:13,325 [cuckoo.core.resultserver] DEBUG: Task #6635959: live log analysis.log initialized.
2025-07-03 01:25:14,433 [cuckoo.core.resultserver] DEBUG: Task #6635959 is sending a BSON stream
2025-07-03 01:25:14,847 [cuckoo.core.resultserver] DEBUG: Task #6635959 is sending a BSON stream
2025-07-03 01:25:15,670 [cuckoo.core.resultserver] DEBUG: Task #6635959: File upload for 'shots/0001.jpg'
2025-07-03 01:25:15,696 [cuckoo.core.resultserver] DEBUG: Task #6635959 uploaded file length: 115304
2025-07-03 01:25:24,659 [cuckoo.core.resultserver] DEBUG: Task #6635959 is sending a BSON stream
2025-07-03 01:25:26,189 [cuckoo.core.resultserver] DEBUG: Task #6635959: File upload for 'shots/0002.jpg'
2025-07-03 01:25:26,197 [cuckoo.core.resultserver] DEBUG: Task #6635959 uploaded file length: 87429
2025-07-03 01:25:27,361 [cuckoo.core.resultserver] DEBUG: Task #6635959: File upload for 'shots/0003.jpg'
2025-07-03 01:25:27,394 [cuckoo.core.resultserver] DEBUG: Task #6635959 uploaded file length: 128218
2025-07-03 01:25:28,742 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:25:43,860 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:25:58,937 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:26:14,140 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:26:29,568 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:26:44,670 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:26:59,965 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:27:15,127 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:27:30,286 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:27:45,511 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:28:00,675 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:28:16,091 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:28:31,382 [cuckoo.core.guest] DEBUG: win7x641: analysis #6635959 still processing
2025-07-03 01:28:33,934 [cuckoo.core.resultserver] DEBUG: Task #6635959: File upload for 'curtain/1750960859.59.curtain.log'
2025-07-03 01:28:33,937 [cuckoo.core.resultserver] DEBUG: Task #6635959 uploaded file length: 36
2025-07-03 01:28:35,138 [cuckoo.core.resultserver] DEBUG: Task #6635959: File upload for 'sysmon/1750960860.62.sysmon.xml'
2025-07-03 01:28:35,309 [cuckoo.core.resultserver] DEBUG: Task #6635959 uploaded file length: 13478064
2025-07-03 01:28:35,348 [cuckoo.core.resultserver] DEBUG: Task #6635959 had connection reset for <Context for LOG>
2025-07-03 01:28:37,692 [cuckoo.core.guest] INFO: win7x641: analysis completed successfully
2025-07-03 01:28:37,734 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-03 01:28:37,795 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-03 01:28:38,857 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x641 to path /srv/cuckoo/cwd/storage/analyses/6635959/memory.dmp
2025-07-03 01:28:38,858 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x641
2025-07-03 01:30:02,726 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.201 for task #6635959
2025-07-03 01:30:03,125 [cuckoo.core.scheduler] DEBUG: Released database task #6635959
2025-07-03 01:30:03,142 [cuckoo.core.scheduler] INFO: Task #6635959: analysis procedure completed