Analyzer Log
2025-06-21 12:37:06,030 [analyzer] DEBUG: Starting analyzer from: C:\tmpk4d6bl
2025-06-21 12:37:06,046 [analyzer] DEBUG: Pipe server name: \??\PIPE\xoDGWDoordkxDdYBIsQ
2025-06-21 12:37:06,046 [analyzer] DEBUG: Log pipe server name: \??\PIPE\kpWcezDkHHABtCRwgB
2025-06-21 12:37:06,046 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-06-21 12:37:06,046 [analyzer] INFO: Automatically selected analysis package "exe"
2025-06-21 12:37:06,328 [analyzer] DEBUG: Started auxiliary module Curtain
2025-06-21 12:37:06,328 [analyzer] DEBUG: Started auxiliary module DbgView
2025-06-21 12:37:06,875 [analyzer] DEBUG: Started auxiliary module Disguise
2025-06-21 12:37:07,108 [analyzer] DEBUG: Loaded monitor into process with pid 512
2025-06-21 12:37:07,108 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-06-21 12:37:07,108 [analyzer] DEBUG: Started auxiliary module Human
2025-06-21 12:37:07,108 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-06-21 12:37:07,108 [analyzer] DEBUG: Started auxiliary module Reboot
2025-06-21 12:37:07,171 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-06-21 12:37:07,171 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-06-21 12:37:07,187 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-06-21 12:37:07,187 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-06-21 12:37:07,328 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\3843ac7d01269083_ywqoigbytq.exe' with arguments '' and pid 2492
2025-06-21 12:37:07,500 [analyzer] DEBUG: Loaded monitor into process with pid 2492
2025-06-21 12:37:08,030 [analyzer] INFO: Added new file to list with pid 2492 and path C:\Temp\CreateProcess.exe
2025-06-21 12:37:09,030 [analyzer] INFO: Added new file to list with pid 2492 and path C:\Temp\bwtomgeywrojgbzt.exe
2025-06-21 12:37:09,140 [analyzer] INFO: Injected into process with pid 2208 and name u'bwtomgeywrojgbzt.exe'
2025-06-21 12:37:09,250 [analyzer] INFO: Injected into process with pid 2456 and name u'iexplore.exe'
2025-06-21 12:37:09,296 [analyzer] DEBUG: Loaded monitor into process with pid 2208
2025-06-21 12:37:09,328 [analyzer] INFO: Added new file to list with pid 2208 and path \Device\NamedPipe\lsass
2025-06-21 12:37:09,467 [analyzer] DEBUG: Loaded monitor into process with pid 2456
2025-06-21 12:37:11,250 [analyzer] INFO: Added new file to list with pid 2492 and path C:\Temp\bwtomgeywrojgbzt.sys
2025-06-21 12:37:11,983 [analyzer] INFO: Added new file to list with pid 2208 and path C:\Temp\xrpkhcausm.exe
2025-06-21 12:37:12,062 [analyzer] INFO: Injected into process with pid 1032 and name u'CreateProcess.exe'
2025-06-21 12:37:12,203 [analyzer] DEBUG: Loaded monitor into process with pid 1032
2025-06-21 12:37:12,328 [analyzer] INFO: Process with pid 2492 has terminated
2025-06-21 12:37:13,328 [analyzer] INFO: Process with pid 1032 has terminated
2025-06-21 12:37:14,592 [analyzer] INFO: Added new file to list with pid 2208 and path C:\Temp\i_xrpkhcausm.exe
2025-06-21 12:37:19,937 [analyzer] INFO: Added new file to list with pid 2208 and path C:\Temp\mhezxrpjhb.exe
2025-06-21 12:40:26,328 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-06-21 12:40:27,546 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-06-21 12:40:27,546 [lib.api.process] INFO: Successfully terminated process with pid 2208.
2025-06-21 12:40:27,546 [lib.api.process] INFO: Successfully terminated process with pid 2456.
2025-06-21 12:40:27,546 [analyzer] WARNING: File at path u'\\device\\namedpipe\\lsass' does not exist, skip.
2025-06-21 12:40:27,562 [analyzer] INFO: Analysis completed.
Cuckoo Log
2025-06-25 12:08:41,033 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:42,383 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:43,429 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:44,515 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:45,618 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:46,712 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:47,797 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:49,110 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:50,155 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:51,217 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:52,581 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:53,837 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:54,912 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:55,949 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:56,980 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:58,019 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:08:59,056 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:00,104 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:01,144 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:02,196 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:03,237 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:04,277 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:05,322 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:06,364 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:07,412 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:08,450 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:09,514 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:10,567 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:11,606 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:12,653 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:13,692 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:14,741 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:15,772 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:16,820 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:17,887 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:18,960 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:19,993 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:21,230 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:22,276 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:23,325 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:24,375 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:25,415 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:26,448 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:27,493 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:28,537 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:29,570 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:30,607 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:31,680 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:32,723 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:33,774 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:34,816 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:35,851 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:36,894 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:37,922 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:38,981 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:40,018 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:41,078 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:42,240 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:43,289 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:44,333 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:45,385 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:46,430 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:47,605 [cuckoo.core.scheduler] DEBUG: Task #6588446: no machine available yet
2025-06-25 12:09:48,671 [cuckoo.core.scheduler] INFO: Task #6588446: acquired machine win7x6422 (label=win7x6422)
2025-06-25 12:09:48,822 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.222 for task #6588446
2025-06-25 12:09:49,164 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3924927 (interface=vboxnet0, host=192.168.168.222)
2025-06-25 12:09:50,749 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6422
2025-06-25 12:09:51,308 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6422 to vmcloak
2025-06-25 12:12:50,237 [cuckoo.core.guest] INFO: Starting analysis #6588446 on guest (id=win7x6422, ip=192.168.168.222)
2025-06-25 12:12:51,243 [cuckoo.core.guest] DEBUG: win7x6422: not ready yet
2025-06-25 12:12:56,308 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6422, ip=192.168.168.222)
2025-06-25 12:12:56,386 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6422, ip=192.168.168.222, monitor=latest, size=6660546)
2025-06-25 12:12:58,771 [cuckoo.core.resultserver] DEBUG: Task #6588446: live log analysis.log initialized.
2025-06-25 12:12:59,228 [cuckoo.core.resultserver] DEBUG: Task #6588446 is sending a BSON stream
2025-06-25 12:12:59,332 [cuckoo.core.resultserver] DEBUG: Task #6588446 is sending a BSON stream
2025-06-25 12:13:00,192 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'shots/0001.jpg'
2025-06-25 12:13:00,202 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 133504
2025-06-25 12:13:01,181 [cuckoo.core.resultserver] DEBUG: Task #6588446 is sending a BSON stream
2025-06-25 12:13:01,241 [cuckoo.core.resultserver] DEBUG: Task #6588446 is sending a BSON stream
2025-06-25 12:13:04,051 [cuckoo.core.resultserver] DEBUG: Task #6588446 is sending a BSON stream
2025-06-25 12:13:04,519 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'files/559e60906c50c803_xrpkhcausm.exe'
2025-06-25 12:13:04,524 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 369664
2025-06-25 12:13:09,206 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'files/7d0b9d75791397a4_i_xrpkhcausm.exe'
2025-06-25 12:13:09,211 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 369664
2025-06-25 12:13:12,507 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:13:27,829 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:13:42,957 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:13:58,072 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:14:13,370 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:14:28,521 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:14:43,604 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:14:58,752 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:15:13,859 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:15:29,038 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:15:44,215 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:15:59,296 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:16:14,435 [cuckoo.core.guest] DEBUG: win7x6422: analysis #6588446 still processing
2025-06-25 12:16:18,422 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'curtain/1750502426.5.curtain.log'
2025-06-25 12:16:18,425 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 36
2025-06-25 12:16:19,336 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'sysmon/1750502427.42.sysmon.xml'
2025-06-25 12:16:19,458 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 13802038
2025-06-25 12:16:19,481 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'files/b4de7866c7f35a7c_bwtomgeywrojgbzt.sys'
2025-06-25 12:16:19,484 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'files/67abbcf2c3f88cc0_bwtomgeywrojgbzt.exe'
2025-06-25 12:16:19,487 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 369664
2025-06-25 12:16:19,490 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'files/ff2329dd645f00ac_createprocess.exe'
2025-06-25 12:16:19,491 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 3584
2025-06-25 12:16:19,499 [cuckoo.core.resultserver] DEBUG: Task #6588446: File upload for 'files/211731f4eb5053af_mhezxrpjhb.exe'
2025-06-25 12:16:19,503 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 369664
2025-06-25 12:16:19,506 [cuckoo.core.resultserver] DEBUG: Task #6588446 uploaded file length: 300544
2025-06-25 12:16:19,508 [cuckoo.core.resultserver] DEBUG: Task #6588446 had connection reset for <Context for LOG>
2025-06-25 12:16:20,550 [cuckoo.core.guest] INFO: win7x6422: analysis completed successfully
2025-06-25 12:16:20,698 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-06-25 12:16:20,844 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-06-25 12:16:21,594 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6422 to path /srv/cuckoo/cwd/storage/analyses/6588446/memory.dmp
2025-06-25 12:16:21,595 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6422
2025-06-25 12:18:29,700 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.222 for task #6588446
2025-06-25 12:18:30,204 [cuckoo.core.scheduler] DEBUG: Released database task #6588446
2025-06-25 12:18:30,224 [cuckoo.core.scheduler] INFO: Task #6588446: analysis procedure completed