Analyzer Log
2025-08-15 22:17:37,000 [analyzer] DEBUG: Starting analyzer from: C:\tmp2pjrvv
2025-08-15 22:17:37,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\DSWZFIbXatAKYyhQfiKKCXDsnWAPU
2025-08-15 22:17:37,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\mobJhaXpZJJLqUxhDARSxgNPmCEw
2025-08-15 22:17:37,405 [analyzer] DEBUG: Started auxiliary module Curtain
2025-08-15 22:17:37,405 [analyzer] DEBUG: Started auxiliary module DbgView
2025-08-15 22:17:37,858 [analyzer] DEBUG: Started auxiliary module Disguise
2025-08-15 22:17:38,062 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-08-15 22:17:38,062 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-08-15 22:17:38,062 [analyzer] DEBUG: Started auxiliary module Human
2025-08-15 22:17:38,062 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-08-15 22:17:38,062 [analyzer] DEBUG: Started auxiliary module Reboot
2025-08-15 22:17:38,125 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-08-15 22:17:38,125 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-08-15 22:17:38,125 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-08-15 22:17:38,125 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-08-15 22:17:38,280 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\c86bdb4a926d74fbd6d03b9c9196a640a0a128e80c8f2979ddd9c15c7c9d431f.exe' with arguments '' and pid 1404
2025-08-15 22:17:38,483 [analyzer] DEBUG: Loaded monitor into process with pid 1404
2025-08-15 22:17:38,515 [analyzer] INFO: Added new file to list with pid 1404 and path C:\$Recycle.Bin\S-1-5-21-3740676788-1466591295-3783685072-500\desktop.ini.tmp
2025-08-15 22:17:38,592 [analyzer] INFO: Added new file to list with pid 1404 and path C:\agent.pyw.tmp
2025-08-15 22:17:38,671 [analyzer] INFO: Added new file to list with pid 1404 and path C:\msdia80.dll.tmp
2025-08-15 22:17:39,250 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\Office32WW.msi.tmp
2025-08-15 22:17:40,453 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\Office32WW.xml.tmp
2025-08-15 22:17:40,515 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\ose.exe.tmp
2025-08-15 22:17:40,655 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\osetup.dll.tmp
2025-08-15 22:17:44,765 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\PidGenX.dll.tmp
2025-08-15 22:17:45,750 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.tmp
2025-08-15 22:17:46,233 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\setup.exe.tmp
2025-08-15 22:17:47,062 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\Setup.xml.tmp
2025-08-15 22:17:47,203 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\StandardWW.msi.tmp
2025-08-15 22:17:59,280 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0012-0000-1000-0000000FF1CE}-C\StandardWW.xml.tmp
2025-08-15 22:17:59,405 [analyzer] INFO: Added new file to list with pid 1404 and path C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.tmp
2025-08-15 22:18:07,280 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-08-15 22:18:07,733 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-08-15 22:18:07,733 [lib.api.process] INFO: Successfully terminated process with pid 1404.
2025-08-15 22:18:07,733 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\setup.exe.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\$recycle.bin\\s-1-5-21-3740676788-1466591295-3783685072-500\\desktop.ini.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\standardww.msi.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\agent.pyw.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msdia80.dll.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\pidgenx.dll.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\osetup.dll.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\ose.exe.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\office32ww.msi.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\setup.xml.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\office32ww.xml.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] WARNING: File at path u'c:\\msocache\\all users\\{90140000-0012-0000-1000-0000000ff1ce}-c\\standardww.xml.tmp' does not exist, skip.
2025-08-15 22:18:07,953 [analyzer] INFO: Analysis completed.
Cuckoo Log
2025-08-18 15:00:58,037 [cuckoo.core.scheduler] INFO: Task #6849750: acquired machine win7x648 (label=win7x648)
2025-08-18 15:00:58,038 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.208 for task #6849750
2025-08-18 15:00:58,605 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 517214 (interface=vboxnet0, host=192.168.168.208)
2025-08-18 15:00:58,707 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x648
2025-08-18 15:00:59,649 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x648 to vmcloak
2025-08-18 15:03:55,805 [cuckoo.core.guest] INFO: Starting analysis #6849750 on guest (id=win7x648, ip=192.168.168.208)
2025-08-18 15:03:56,811 [cuckoo.core.guest] DEBUG: win7x648: not ready yet
2025-08-18 15:04:01,998 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x648, ip=192.168.168.208)
2025-08-18 15:04:02,124 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x648, ip=192.168.168.208, monitor=latest, size=6660546)
2025-08-18 15:04:03,297 [cuckoo.core.resultserver] DEBUG: Task #6849750: live log analysis.log initialized.
2025-08-18 15:04:04,315 [cuckoo.core.resultserver] DEBUG: Task #6849750 is sending a BSON stream
2025-08-18 15:04:04,720 [cuckoo.core.resultserver] DEBUG: Task #6849750 is sending a BSON stream
2025-08-18 15:04:04,895 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/e1b9ce9b57957b1a_desktop.ini'
2025-08-18 15:04:04,899 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 129
2025-08-18 15:04:04,973 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/7674a841e0162121_agent.pyw'
2025-08-18 15:04:04,975 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 12712
2025-08-18 15:04:05,474 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/c883b5d2e16d22b0_msdia80.dll'
2025-08-18 15:04:05,483 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 904704
2025-08-18 15:04:05,583 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'shots/0001.jpg'
2025-08-18 15:04:05,637 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 133507
2025-08-18 15:04:06,715 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/d2126415b32dadd8_Office32WW.msi'
2025-08-18 15:04:06,755 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 1992192
2025-08-18 15:04:06,824 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/f2332c24397c5064_Office32WW.xml'
2025-08-18 15:04:06,846 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 4274
2025-08-18 15:04:06,964 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/52ad72c05facc1e0_ose.exe'
2025-08-18 15:04:06,969 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 174440
2025-08-18 15:04:10,820 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/dfff75a35f25b8b0_osetup.dll'
2025-08-18 15:04:10,888 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 7378792
2025-08-18 15:04:12,003 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/48b8b32b9ffe3734_PidGenX.dll'
2025-08-18 15:04:12,021 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 1463568
2025-08-18 15:04:12,523 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/edfb49cd35fe352a_pkeyconfig-office.xrm-ms'
2025-08-18 15:04:12,533 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 715834
2025-08-18 15:04:13,314 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/916946889ad9dd85_setup.exe'
2025-08-18 15:04:13,333 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 1377656
2025-08-18 15:04:13,600 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/4009f775a780f7af_Setup.xml'
2025-08-18 15:04:13,796 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 28397
2025-08-18 15:04:18,212 [cuckoo.core.guest] DEBUG: win7x648: analysis #6849750 still processing
2025-08-18 15:04:24,703 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/c1a8a46a852aab17_StandardWW.msi'
2025-08-18 15:04:25,082 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 19756032
2025-08-18 15:04:25,752 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/25dbaa25ce964d41_StandardWW.xml'
2025-08-18 15:04:25,756 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 14617
2025-08-18 15:04:33,746 [cuckoo.core.guest] DEBUG: win7x648: analysis #6849750 still processing
2025-08-18 15:04:33,824 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'curtain/1755289087.5.curtain.log'
2025-08-18 15:04:33,827 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 36
2025-08-18 15:04:34,028 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'sysmon/1755289087.7.sysmon.xml'
2025-08-18 15:04:34,052 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 1775564
2025-08-18 15:04:34,176 [cuckoo.core.resultserver] DEBUG: Task #6849750: File upload for 'files/d2d766702cb5bf59_excellr.cab.tmp'
2025-08-18 15:04:34,271 [cuckoo.core.resultserver] DEBUG: Task #6849750 uploaded file length: 16211968
2025-08-18 15:04:34,637 [cuckoo.core.resultserver] DEBUG: Task #6849750 had connection reset for <Context for LOG>
2025-08-18 15:04:36,762 [cuckoo.core.guest] INFO: win7x648: analysis completed successfully
2025-08-18 15:04:36,777 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-08-18 15:04:36,802 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-08-18 15:04:38,125 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x648 to path /srv/cuckoo/cwd/storage/analyses/6849750/memory.dmp
2025-08-18 15:04:38,127 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x648
2025-08-18 15:07:42,888 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.208 for task #6849750
2025-08-18 15:07:43,254 [cuckoo.core.scheduler] DEBUG: Released database task #6849750
2025-08-18 15:07:43,273 [cuckoo.core.scheduler] INFO: Task #6849750: analysis procedure completed
