cuckoobox/cuckoo — Issue #22: Bug when a file drops that doesn't get created
Author: digdugg
Created: 2012-01-04 13:39:49+00:00
State: open

Here is the analysis.log
=====================

[2012-01-03 14:57:46,937] [Core.Analyzer] INFO: Cuckoo starting with PID 496.

[2012-01-03 14:57:46,947] [Core.InstallDependencies] INFO: Installing dependency "\\VBOXSVR\setup\system\distorm3.dll".

[2012-01-03 14:57:46,976] [Core.InstallDependencies] INFO: Installing dependency "\\VBOXSVR\setup\system\.gitignore".

[2012-01-03 14:57:46,986] [Core.InstallCuckoo] INFO: Installing "\\VBOXSVR\setup\cuckoo\dll".

[2012-01-03 14:57:47,016] [Core.InstallCuckoo] INFO: Installing "\\VBOXSVR\setup\cuckoo\logs".

[2012-01-03 14:57:47,026] [Core.InstallCuckoo] INFO: Installing "\\VBOXSVR\setup\cuckoo\trace".

[2012-01-03 14:57:47,046] [Core.InstallCuckoo] INFO: Installing "\\VBOXSVR\setup\cuckoo\files".

[2012-01-03 14:57:47,056] [Core.InstallCuckoo] INFO: Installing "\\VBOXSVR\setup\cuckoo\shots".

[2012-01-03 14:57:47,076] [Core.InstallTarget] INFO: Installing target file from "\\VBOXSVR\cuckoo1\malware.exe" to "C:\".

[2012-01-03 14:57:47,137] [Core.PipeServer] INFO: Starting Pipe Server.

[2012-01-03 14:57:47,137] [Core.Analyzer] INFO: Analysis package imported from "packages.exe".

[2012-01-04 08:30:40,796] [Core.Analyzer] INFO: Executing analysis package run function.

[2012-01-04 08:30:40,796] [Screenshots.Run] INFO: Started taking screenshots.

[2012-01-04 08:30:40,806] [Execute.Execute] INFO: Launched process "C:\malware.exe" with arguments "None", ID "1544" and thread "0x0000074c".

[2012-01-04 08:30:40,917] [Monitor.Monitor] INFO: Using default Cuckoo DLL "C:\cuckoo\dll\cmonitor.dll".

[2012-01-04 08:30:41,016] [Inject.GrantDebugPrivilege] INFO: Successfully granted debug privileges on Cuckoo process.

[2012-01-04 08:30:41,127] [Inject.Inject] DEBUG: Process with PID 1544 successfully injected with DLL at path "C:\cuckoo\dll\awUuyd.dll".

[2012-01-04 08:30:41,256] [Monitor.Monitor] INFO: Original process with PID "1544" successfully injected.

[2012-01-04 08:30:41,286] [Screenshots.Run] DEBUG: Screenshot saved at "C:\cuckoo\shots\shot_1.jpg".

[2012-01-04 08:30:43,289] [Monitor.ResumeThread] INFO: Resumed thread with handle "0x0000074c".

[2012-01-04 08:30:43,299] [Core.Analyzer] INFO: Analysis package returned following process PID to add to monitor list: 1544.

[2012-01-04 08:30:43,299] [Core.AddFile] INFO: Newly created file path added to list: ÿÿ

[2012-01-04 08:30:43,309] [Core.Analyzer] INFO: Running for a maximum of 150 seconds.

[2012-01-04 08:30:43,329] [Core.AddFile] INFO: Newly created file path added to list: C:\WINDOWS\System32\rs32net.exe

[2012-01-04 08:30:43,329] [Core.PipeHandler] DEBUG: Received request to analyze process with PID 0.

[2012-01-04 08:30:43,339] [Inject.GrantDebugPrivilege] INFO: Successfully granted debug privileges on Cuckoo process.

[2012-01-04 08:30:43,339] [Inject.Inject] ERROR: Unable to obtain handle on process with PID 0 (GLE=87). Abort.

[2012-01-04 08:30:43,339] [Core.PipeHandler] ERROR: Failed injecting process with PID "0" (0x00000000).

[2012-01-04 08:30:43,339] [Core.Analyzer] INFO: Process with PID 1544 terminated.

[2012-01-04 08:30:44,351] [Core.PipeServer] INFO: Stopping Pipe Server.

[2012-01-04 08:30:44,351] [Screenshots.Stop] INFO: Stopping screenshots.

[2012-01-04 08:30:44,351] [Core.Analyzer] INFO: Analysis completed.

[2012-01-04 08:30:44,351] [Core.Analyzer] INFO: Executing analysis package "exe" custom finish function.

[2012-01-04 08:30:44,351] [Core.DumpFiles] DEBUG: Dropped file "ÿÿ" does not exist. Skip.

[2012-01-04 08:30:44,351] [Core.DumpFiles] DEBUG: Dropped file "C:\WINDOWS\System32\rs32net.exe" does not exist. Skip.

[2012-01-04 08:30:44,361] [Core.SaveResults] INFO: Saving analysis results to "\\VBOXSVR\cuckoo1\".

Here is my error dialogue in python 2.6

_
____ _ _ ____| | _ ___ ___
/ ___) | | |/ ___) |_/ ) _ \ / _ \
( (___| |_| ( (___| _ ( |_| | |_| |
\____)____/ \____)_| \_)___/ \___/ v0.3.1

www.cuckoobox.org
Copyright (C) 2010-2011

[2012-01-04 05:30:16,302] [Core.Init] INFO: Started.
[2012-01-04 05:30:16,860] [VirtualMachine.Check] INFO: Your VirtualBox version is: "4.1.8", good!
[2012-01-04 05:30:16,860] [Core.Init] INFO: Populating virtual machines pool...
[2012-01-04 05:30:17,324] [VirtualMachine.Restore] INFO: Virtual machine "Cuckoo1" successfully restored to current snapshot.
[2012-01-04 05:30:17,379] [VirtualMachine.Infos] INFO: Virtual machine "Cuckoo1" information:
[2012-01-04 05:30:17,380] [VirtualMachine.Infos] INFO:	\_| Name: Cuckoo1
[2012-01-04 05:30:17,380] [VirtualMachine.Infos] INFO:	| ID: 2fe4b559-5886-4897-b1f3-37eeb6a9e207
[2012-01-04 05:30:17,380] [VirtualMachine.Infos] INFO:	| CPU Count: 1 Core/s
[2012-01-04 05:30:17,380] [VirtualMachine.Infos] INFO:	| Memory Size: 512 MB
[2012-01-04 05:30:17,380] [VirtualMachine.Infos] INFO:	| VRAM Size: 16 MB
[2012-01-04 05:30:17,381] [VirtualMachine.Infos] INFO:	| State: Saved
[2012-01-04 05:30:17,381] [VirtualMachine.Infos] INFO:	| Current Snapshot: "cuckoo-3"
[2012-01-04 05:30:17,381] [VirtualMachine.Infos] INFO:	| MAC Address: 08:00:27:39:8E:14
[2012-01-04 05:30:17,403] [Core.Init] INFO: 1 virtual machine/s added to pool.
[2012-01-04 05:30:26,422] [Core.Dispatcher] INFO: Acquired analysis task for target "../malware.exe".
[2012-01-04 05:30:26,464] (Task #13) [Core.Analysis.Run] INFO: Acquired virtual machine "cuckoo1".
[2012-01-04 05:30:26,467] [Sniffer.Start] INFO: Sniffer started monitoring 08:00:27:39:8E:14.
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 1515 bytes
[2012-01-04 05:30:26,789] [VirtualMachine.Restore] INFO: Virtual machine "Cuckoo1" successfully restored to current snapshot.
[2012-01-04 05:30:29,261] [VirtualMachine.Start] INFO: Virtual machine "Cuckoo1" starting in "gui" mode.
[2012-01-04 05:30:29,364] [VirtualMachine.Execute] INFO: Cuckoo analyzer running with PID 496 on virtual machine "Cuckoo1".
[2012-01-04 05:30:44,464] [VirtualMachine.Execute] INFO: Cuckoo analyzer exited with code 0 on virtual machine "Cuckoo1".
[2012-01-04 05:30:44,465] [Sniffer.Stop] INFO: Sniffer stopped monitoring 08:00:27:39:8E:14.
0 packets captured
0 packets received by filter
0 packets dropped by kernel
[2012-01-04 05:30:44,670] (Task #13) [Core.Analysis.SaveResults] INFO: Analysis results successfully saved to "analysis/13".
[2012-01-04 05:30:44,792] (Task #13) [Core.Analysis.Processing] INFO: Analysis results processor started with PID "27141".
Traceback (most recent call last):
File "processor.py", line 35, in
main(sys.argv[1])
File "processor.py", line 28, in main
ReportProcessor().report(CuckooDict(analysis_path).process())
File "/home/malware/cuckoo/cuckoo/cuckoo/reporting/reporter.py", line 58, in report
self._observable.notify(report)
File "/home/malware/cuckoo/cuckoo/cuckoo/reporting/observers.py", line 57, in notify
observer.update(results)
File "/home/malware/cuckoo/cuckoo/cuckoo/reporting/tasks/reporthtml.py", line 56, in update
html = template.render(**results)
File "/usr/lib/pymodules/python2.6/mako/template.py", line 133, in render
return runtime._render(self, self.callable_, args, data)
File "/usr/lib/pymodules/python2.6/mako/runtime.py", line 364, in _render
_render_context(template, callable_, context, *args, **_kwargs_for_callable(callable_, data))
File "/usr/lib/pymodules/python2.6/mako/runtime.py", line 381, in _render_context
_exec_template(inherit, lclcontext, args=args, kwargs=kwargs)
File "/usr/lib/pymodules/python2.6/mako/runtime.py", line 414, in _exec_template
callable_(context, *args, **kwargs)
File "base_html", line 37, in render_body
File "/usr/lib/pymodules/python2.6/mako/runtime.py", line 255, in
return lambda *args, **kwargs:callable_(self.context, *args, **kwargs)
File "report_html", line 48, in render_content
File "/usr/lib/pymodules/python2.6/mako/runtime.py", line 307, in _include_file
callable_(ctx, **_kwargs_for_callable(callable_, context._orig, **kwargs))
File "sections_general_information_html", line 64, in render_body
UnicodeDecodeError: 'ascii' codec can't decode byte 0xff in position 2289: ordinal not in range(128)
[2012-01-04 05:30:45,973] [VirtualMachine.Stop] INFO: Virtual machine "Cuckoo1" powered off successfully.
[2012-01-04 05:30:45,975] (Task #13) [Core.Analysis.FreeVM] INFO: Virtual machine "cuckoo1" released.
[2012-01-04 05:30:45,975] (Task #13) [Core.Analysis.Run] INFO: Analyis completed.
^C[2012-01-04 05:31:02,423] [Core.Init] CRITICAL: Keyboard interrupt catched! Forcing shutdown and restore of all virtual machines before exiting...
[2012-01-04 05:31:02,639] [VirtualMachine.Restore] INFO: Virtual machine "Cuckoo1" successfully restored to current snapshot.

MALWARE ZIP THAT CAUSES BUG
=================
http://www.mediafire.com/?g9li126nhqul91t

^ IS MALWARE...