{"action":"created","issue":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2248","repository_url":"https://api.github.com/repos/cuckoosandbox/cuckoo","labels_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2248/labels{/name}","comments_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2248/comments","events_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2248/events","html_url":"https://github.com/cuckoosandbox/cuckoo/issues/2248","id":317598801,"number":2248,"title":"Analysis Exception: The system cannot find the file specified","user":{"login":"doria90","id":12772781,"avatar_url":"https://avatars0.githubusercontent.com/u/12772781?v=4","gravatar_id":"","url":"https://api.github.com/users/doria90","html_url":"https://github.com/doria90","followers_url":"https://api.github.com/users/doria90/followers","following_url":"https://api.github.com/users/doria90/following{/other_user}","gists_url":"https://api.github.com/users/doria90/gists{/gist_id}","starred_url":"https://api.github.com/users/doria90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/doria90/subscriptions","organizations_url":"https://api.github.com/users/doria90/orgs","repos_url":"https://api.github.com/users/doria90/repos","events_url":"https://api.github.com/users/doria90/events{/privacy}","received_events_url":"https://api.github.com/users/doria90/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":18,"created_at":"2018-04-25T12:05:07Z","updated_at":"2018-05-02T09:35:57Z","closed_at":null,"author_association":"NONE","body":"Hi guys,\r\nI've installed cuckoo on Windows 10 following some guides online, using VMWare Workstation as my virtualization provider.\r\nEverything worked fine until for some reason, I've started to receive errors on my analyses.. I think the file I submit isn't being uploaded to the guest machine somehow.\r\n\r\nThe guest machine is a Windows 10 with the Administrator account active. I've placed the agent.pyw under **shell:startup**. Defender,Firewall, Windows updates, OneDrive - are all disabled\r\n\r\n\r\nThis is the cuckoo log:\r\n`\r\n2018-04-25 14:52:33,667 [cuckoo.core.scheduler] INFO: Task #82: acquired machine win10_x64 (label=C:\\virtualMachines\\win10_x64\\win10_x64.vmx)`\r\n`\r\n2018-04-25 14:52:33,691 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1476 (interface=\\Device\\NPF_{2CE62467-4C18-4AE7-BC72-5E4A120934B9}, host=192.168.56.23)`\r\n`2018-04-25 14:52:33,693 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer`\r\n`2018-04-25 14:52:34,095 [cuckoo.machinery.vmware] DEBUG: Revert snapshot for vm C:\\virtualMachines\\win10_x64\\win10_x64.vmx`\r\n`2018-04-25 14:52:37,851 [cuckoo.machinery.vmware] DEBUG: Starting vm C:\\virtualMachines\\win10_x64\\win10_x64.vmx`\r\n`2018-04-25 14:52:49,815 [cuckoo.core.guest] INFO: Starting analysis on guest (id=win10_x64, ip=192.168.56.23)\r\n2018-04-25 14:52:50,819 [cuckoo.core.guest] DEBUG: win10_x64: not ready yet\r\n2018-04-25 14:52:50,829 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.8 (id=win10_x64, ip=192.168.56.23)`\r\n`2018-04-25 14:52:50,867 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win10_x64, ip=192.168.56.23, monitor=latest, size=3814549)\r\n2018-04-25 14:52:53,265 [cuckoo.core.guest] DEBUG: win10_x64: analysis still processing\r\n2018-04-25 14:52:54,029 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.\r\n2018-04-25 14:52:54,270 [cuckoo.core.guest] DEBUG: win10_x64: analysis still processing`\r\n\r\n`2018-04-25 14:52:55,275 [cuckoo.core.guest] WARNING: win10_x64: analysis caught an exception`\r\n\r\n`Traceback (most recent call last):\r\n  File \"C:/tmpfkzipi/analyzer.py\", line 798, in <module> success = analyzer.run()\r\n  File \"C:/tmpfkzipi/analyzer.py\", line 650, in pids = self.package.start(self.target)\r\n  File \"C:\\tmpfkzipi\\modules\\packages\\xls.py\", line 62, in excel, args=[path], mode=\"office\", trigger=\"file:%s\" % path\r\n  File \"C:\\tmpfkzipi\\lib\\common\\abstracts.py\", line 164, in maximize=maximize, env=env, trigger=trigger):\r\n  File \"C:\\tmpfkzipi\\lib\\api\\process.py\", line 275, in execute output = subprocess_checkoutput(argv, env)\r\n  File \"C:\\tmpfkzipi\\lib\\api\\process.py\", line 32, in subprocess_checkoutput\r\n    args, stdin=subprocess.PIPE, stderr=subprocess.PIPE, env=env,\r\n  File \"C:\\Python27\\lib\\subprocess.py\", line 212, in check_output\r\n    process = Popen(stdout=PIPE, *popenargs, **kwargs)\r\n  File \"C:\\Python27\\lib\\subprocess.py\", line 390, in __init__\r\n    errread, errwrite)\r\n  File \"C:\\Python27\\lib\\subprocess.py\", line 640, in _execute_child\r\n    startupinfo)`\r\n\r\nWindowsError: [Error 2] The system cannot find the file specified\r\n`\r\n\r\n\r\n`2018-04-25 14:52:55,289 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer\r\n2018-04-25 14:52:55,289 [cuckoo.machinery.vmware] DEBUG: Stopping vm C:\\virtualMachines\\win10_x64\\win10_x64.vmx\r\n2018-04-25 14:52:59,125 [cuckoo.core.scheduler] DEBUG: Released database task #82\r\n2018-04-25 14:52:59,157 [cuckoo.core.plugins] DEBUG: Executed processing module \"AnalysisInfo\" for task #82\r\n2018-04-25 14:52:59,158 [cuckoo.core.plugins] DEBUG: Executed processing module \"Dropped\" for task #82\r\n2018-04-25 14:52:59,161 [cuckoo.core.plugins] DEBUG: Executed processing module \"DroppedBuffer\" for task #82\r\n2018-04-25 14:52:59,181 [cuckoo.core.plugins] DEBUG: Executed processing module \"MetaInfo\" for task #82\r\n2018-04-25 14:52:59,183 [cuckoo.core.plugins] DEBUG: Executed processing module \"ProcessMemory\" for task #82\r\n2018-04-25 14:52:59,184 [cuckoo.core.plugins] DEBUG: Executed processing module \"Procmon\" for task #82\r\n2018-04-25 14:52:59,186 [cuckoo.core.plugins] DEBUG: Executed processing module \"Screenshots\" for task #82\r\n2018-04-25 14:52:59,194 [cuckoo.core.plugins] DEBUG: Executed processing module \"Static\" for task #82\r\n2018-04-25 14:52:59,201 [cuckoo.core.plugins] DEBUG: Executed processing module \"Strings\" for task #82\r\n2018-04-25 14:52:59,217 [cuckoo.core.plugins] DEBUG: Executed processing module \"TargetInfo\" for task #82\r\n2018-04-25 14:53:10,532 [cuckoo.core.plugins] DEBUG: Executed processing module \"NetworkAnalysis\" for task #82\r\n2018-04-25 14:53:10,535 [cuckoo.core.plugins] DEBUG: Executed processing module \"Extracted\" for task #82\r\n2018-04-25 14:53:10,536 [cuckoo.core.plugins] DEBUG: Executed processing module \"TLSMasterSecrets\" for task #82\r\n2018-04-25 14:53:10,542 [cuckoo.core.plugins] DEBUG: Executed processing module \"Debug\" for task #82\r\n2018-04-25 14:53:10,546 [cuckoo.core.plugins] DEBUG: Running 473 signatures\r\n2018-04-25 14:53:10,673 [cuckoo.core.plugins] DEBUG: Analysis matched signature: network_http\r\n2018-04-25 14:53:10,678 [cuckoo.core.plugins] DEBUG: Executed reporting module \"JsonDump\"\r\n`\r\n\r\nI'd love your help on this one! As far as I can tell, nothing has suddenly changed, not that I'm aware of at least.. so I'm quite stuck at the moment, trying to figure out what the heck.\r\n"},"comment":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/comments/385920642","html_url":"https://github.com/cuckoosandbox/cuckoo/issues/2248#issuecomment-385920642","issue_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2248","id":385920642,"user":{"login":"doria90","id":12772781,"avatar_url":"https://avatars0.githubusercontent.com/u/12772781?v=4","gravatar_id":"","url":"https://api.github.com/users/doria90","html_url":"https://github.com/doria90","followers_url":"https://api.github.com/users/doria90/followers","following_url":"https://api.github.com/users/doria90/following{/other_user}","gists_url":"https://api.github.com/users/doria90/gists{/gist_id}","starred_url":"https://api.github.com/users/doria90/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/doria90/subscriptions","organizations_url":"https://api.github.com/users/doria90/orgs","repos_url":"https://api.github.com/users/doria90/repos","events_url":"https://api.github.com/users/doria90/events{/privacy}","received_events_url":"https://api.github.com/users/doria90/received_events","type":"User","site_admin":false},"created_at":"2018-05-02T09:35:57Z","updated_at":"2018-05-02T09:35:57Z","author_association":"NONE","body":"AAAAND it WORKS!\r\nDunno what happend or why this fixed it, but thanks for all the help!\r\n\r\nCan close "}}
{"actor":{"display_login":"doria90"}}