Summary

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6962670

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

2025-09-09 06:08:45,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpdrdvpd
2025-09-09 06:08:45,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\HrbBwqHyIGTdtLlSvXulG
2025-09-09 06:08:45,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\KfsQPhDMwcJfOWYlVxubSABEHCHm
2025-09-09 06:08:45,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-09-09 06:08:45,030 [analyzer] INFO: Automatically selected analysis package "generic"
2025-09-09 06:08:45,280 [analyzer] DEBUG: Started auxiliary module Curtain
2025-09-09 06:08:45,280 [analyzer] DEBUG: Started auxiliary module DbgView
2025-09-09 06:08:45,812 [analyzer] DEBUG: Started auxiliary module Disguise
2025-09-09 06:08:46,000 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-09-09 06:08:46,000 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-09-09 06:08:46,000 [analyzer] DEBUG: Started auxiliary module Human
2025-09-09 06:08:46,000 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-09-09 06:08:46,000 [analyzer] DEBUG: Started auxiliary module Reboot
2025-09-09 06:08:46,078 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-09-09 06:08:46,092 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-09-09 06:08:46,092 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-09-09 06:08:46,092 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-09-09 06:08:46,171 [lib.api.process] INFO: Successfully executed process from path 'C:\\Windows\\System32\\cmd.exe' with arguments ['/c', 'start', '/wait', '"qGXiMAnDGcGyfo"', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\a885b7b4e07de7c1_microsoft .net framework 4.7.1 full.prq'] and pid 2128
2025-09-09 06:08:46,483 [analyzer] DEBUG: Loaded monitor into process with pid 2128
2025-09-09 06:08:46,858 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,890 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,890 [analyzer] CRITICAL: Error creating function stub for advapi32!DeleteService.
2025-09-09 06:08:46,905 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,905 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,921 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,921 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 10 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,921 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,921 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,921 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,921 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,937 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,937 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,937 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,937 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,967 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 7 to RWX (error code 0xc000004e)!
2025-09-09 06:08:46,967 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,967 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:46,967 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,015 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,015 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,015 [analyzer] CRITICAL: Error creating function stub for advapi32!DeleteService.
2025-09-09 06:08:47,030 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,030 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,030 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,030 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 10 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,030 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,030 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 7 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,046 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,483 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,483 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,483 [analyzer] CRITICAL: Error creating function stub for advapi32!DeleteService.
2025-09-09 06:08:47,500 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,500 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,500 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,500 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 10 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,515 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,515 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,515 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,515 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,515 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,530 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,530 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 7 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,530 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,546 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,546 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!ControlService at 0x09f2f0 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,671 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,671 [analyzer] CRITICAL: Error creating function stub for advapi32!DeleteService.
2025-09-09 06:08:47,671 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerA at 0x09f336 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenSCManagerW at 0x09f4a8 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,687 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,687 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceA at 0x09f43e 10 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,687 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!OpenServiceW at 0x09f488 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,703 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegCloseKey at 0x09f6b4 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,703 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,703 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueA at 0x09f5ee 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,703 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!RegDeleteValueW at 0x09f5dc 5 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceCtrlDispatcherW at 0x09f276 7 to RWX (error code 0xc000004e)!
2025-09-09 06:08:47,717 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,717 [analyzer] CRITICAL: Conditional jumps in 64-bit are considered unstable!
2025-09-09 06:08:47,717 [analyzer] CRITICAL: Unable to change memory protection of advapi32!StartServiceW at 0x09f4cc 6 to RWX (error code 0xc000004e)!
2025-09-09 06:08:53,515 [analyzer] INFO: Injected into process with pid 2940 and name u'rundll32.exe'
2025-09-09 06:08:53,921 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 2940.
2025-09-09 06:08:54,155 [analyzer] DEBUG: Loaded monitor into process with pid 2940
2025-09-09 05:12:34,122 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-09-09 05:12:34,513 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-09-09 05:12:34,513 [lib.api.process] INFO: Successfully terminated process with pid 2128.
2025-09-09 05:12:34,513 [lib.api.process] INFO: Successfully terminated process with pid 2940.
2025-09-09 05:12:34,513 [analyzer] INFO: Analysis completed.

2025-09-09 06:08:54,448 [cuckoo.core.scheduler] INFO: Task #6962674: acquired machine win7x6412 (label=win7x6412)
2025-09-09 06:08:54,448 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.212 for task #6962674
2025-09-09 06:08:54,973 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1188200 (interface=vboxnet0, host=192.168.168.212)
2025-09-09 06:08:55,008 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6412
2025-09-09 06:08:56,065 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6412 to vmcloak
2025-09-09 06:09:06,457 [cuckoo.core.guest] INFO: Starting analysis #6962674 on guest (id=win7x6412, ip=192.168.168.212)
2025-09-09 06:09:07,462 [cuckoo.core.guest] DEBUG: win7x6412: not ready yet
2025-09-09 06:09:12,491 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6412, ip=192.168.168.212)
2025-09-09 06:09:12,574 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6412, ip=192.168.168.212, monitor=latest, size=6660546)
2025-09-09 06:09:13,859 [cuckoo.core.resultserver] DEBUG: Task #6962674: live log analysis.log initialized.
2025-09-09 06:09:14,782 [cuckoo.core.resultserver] DEBUG: Task #6962674 is sending a BSON stream
2025-09-09 06:09:15,167 [cuckoo.core.resultserver] DEBUG: Task #6962674 is sending a BSON stream
2025-09-09 06:09:16,065 [cuckoo.core.resultserver] DEBUG: Task #6962674: File upload for 'shots/0001.jpg'
2025-09-09 06:09:16,079 [cuckoo.core.resultserver] DEBUG: Task #6962674 uploaded file length: 110724
2025-09-09 06:09:22,844 [cuckoo.core.resultserver] DEBUG: Task #6962674 is sending a BSON stream
2025-09-09 06:09:24,433 [cuckoo.core.resultserver] DEBUG: Task #6962674: File upload for 'shots/0002.jpg'
2025-09-09 06:09:24,450 [cuckoo.core.resultserver] DEBUG: Task #6962674 uploaded file length: 121935
2025-09-09 06:09:28,483 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:09:43,582 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:09:58,688 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:10:13,782 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:10:28,882 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:10:43,973 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:10:59,073 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:11:14,175 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:11:29,269 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:11:44,360 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:11:59,449 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:12:14,540 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:12:29,773 [cuckoo.core.guest] DEBUG: win7x6412: analysis #6962674 still processing
2025-09-09 06:12:34,381 [cuckoo.core.resultserver] DEBUG: Task #6962674: File upload for 'curtain/1757387554.37.curtain.log'
2025-09-09 06:12:34,386 [cuckoo.core.resultserver] DEBUG: Task #6962674 uploaded file length: 36
2025-09-09 06:12:34,513 [cuckoo.core.resultserver] DEBUG: Task #6962674: File upload for 'sysmon/1757387554.5.sysmon.xml'
2025-09-09 06:12:34,523 [cuckoo.core.resultserver] DEBUG: Task #6962674 uploaded file length: 474398
2025-09-09 06:12:34,541 [cuckoo.core.resultserver] DEBUG: Task #6962674 had connection reset for <Context for LOG>
2025-09-09 06:12:35,869 [cuckoo.core.guest] INFO: win7x6412: analysis completed successfully
2025-09-09 06:12:35,894 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-09-09 06:12:35,916 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-09-09 06:12:37,416 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6412 to path /srv/cuckoo/cwd/storage/analyses/6962674/memory.dmp
2025-09-09 06:12:37,418 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6412
2025-09-09 06:12:45,778 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.212 for task #6962674
2025-09-09 06:12:46,108 [cuckoo.core.scheduler] DEBUG: Released database task #6962674
2025-09-09 06:12:46,129 [cuckoo.core.scheduler] INFO: Task #6962674: analysis procedure completed