Signature Errors with latest commits #56

enzok · 2018-07-10T02:07:13Z

I added the latest commits and am now getting the following errors. I've run multiple samples and get the same results.

2018-07-09 22:00:36,972 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "CheckRemoteDebuggerPresent":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/CAPE.py", line 558, in on_call
    ProcessInformationClass = int(self.get_raw_argument(call, "ProcessInformationClass"), 0)
TypeError: int() can't convert non-string with explicit base
2018-07-09 22:00:37,056 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "critical_process":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/critical_process.py", line 34, in on_call
    value = int(self.get_argument(call, "Value"))
TypeError: int() argument must be a string or a number, not 'NoneType'
2018-07-09 22:00:37,056 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "dep_disable":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/dep_disable.py", line 34, in on_call
    value = int(self.get_argument(call, "Value"))
TypeError: int() argument must be a string or a number, not 'NoneType'
2018-07-09 22:00:37,071 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "NtSetInformationThread":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/CAPE.py", line 497, in on_call
    ThreadInformationClass = int(self.get_raw_argument(call, "ThreadInformationClass"), 0)
TypeError: int() can't convert non-string with explicit base

The text was updated successfully, but these errors were encountered:

kevoreilly · 2018-07-10T09:21:47Z

This is my bad - I updated the hook for NtSetInformationProcess and failed to make sure the sigs that depend on it still work. Apologies - should be fixed in latest commit.

enzok · 2018-07-10T15:30:55Z

Thanks. These errors were fixed.

I did get the following error running a Ursnif sample. It decoded the config so not sure if it's a real issue. I'll let you decided.

2018-07-10 11:27:38,879 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "NtCreateThreadEx":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/CAPE.py", line 517, in on_call
    ThreadCreationFlags = int(self.get_raw_argument(call, "CreateFlags"), 0)
TypeError: int() can't convert non-string with explicit base

redsand · 2018-07-10T16:49:59Z

Good find. thanks for this

kevoreilly · 2018-07-10T17:42:19Z

Should be fixed now

kevoreilly · 2018-07-10T19:04:59Z

Damn actually this looks to be because I had a slightly different hook for NtCreateThreadEx for the Ursnif package. I had 'CreationFlags' to be more like the other hook creation functions whereas the current hook has 'CreateFlags' for this argument (it's not easy to find the actual prototype, some even have this as a BOOL CreateSuspended). I have a new version of the Ursnif package in the works which has 'CreateFlags' but I will need to publish this then switch the signature back again...

redsand · 2018-07-10T20:28:17Z

Good find

…

On Tue, Jul 10, 2018 at 2:13 PM, kevoreilly ***@***.***> wrote: Damn actually this looks to be because I had a slightly different hook for NtCreateThreadEx for the Ursnif package. I had 'CreationFlags' to be more like the other hook creation functions whereas the current hook has 'CreateFlags' for this argument (it's not easy to find the actual prototype, some even have this as a BOOL CreateSuspended). I have a new version of the Ursnif package in the works which has 'CreateFlags' but I will need to publish this then switch the signature back again... — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#56 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAhV894FYBoYRhDqXAc9KfGS_cd4O7t6ks5uFPzbgaJpZM4VIpdS> .

enzok · 2018-07-23T17:59:47Z

Just got back from vacation. I added the CAPE commits since July 10th and am getting the following in my logs:

2018-07-23 13:44:56,090 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "NtCreateThreadEx":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/CAPE.py", line 527, in on_call
    ThreadCreationFlags = int(self.get_raw_argument(call, "CreationFlags"), 16)
TypeError: int() can't convert non-string with explicit base
2018-07-23 13:44:56,090 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "NtCreateThreadEx":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/CAPE.py", line 527, in on_call
    ThreadCreationFlags = int(self.get_raw_argument(call, "CreationFlags"), 16)
TypeError: int() can't convert non-string with explicit base

kevoreilly · 2018-07-23T18:10:55Z

I've just pushed a fix for this but this will unfortunately mean you will get sig errors with the Ursnif package as it had a different label for the NtCreateThreadEx argument (CreationFlags) - until I push an update to the Ursnif Dlls. I will try and get that done soon, I have an update in the works.

enzok · 2018-07-24T13:00:16Z

That is the error I received with the latest commits on a non-Ursnif sample. I did check the MD5s to confirm that I have the latest analyzer DLLs.

kevoreilly · 2018-07-27T11:16:19Z

This should be fixed now (except for Ursnif package which I will update soon).

enzok · 2018-07-27T12:51:48Z

Is there an updated DLL or just the Cape.py file?

kevoreilly · 2018-07-27T13:38:20Z

The majority of the DLLs already have the matching argument string 'CreateFlags'. The exception to this is the Ursnif DLLs (CreationFlags) but I have an updated version which I plan to release soon.

enzok · 2018-07-27T14:12:25Z

OK understood. Thank you.

enzok · 2018-07-27T14:38:11Z

Still getting this error.

2018-07-27 10:23:24,083 [lib.cuckoo.core.plugins] ERROR: Failed to run signature "NtCreateThreadEx":
Traceback (most recent call last):
  File "/opt/cuckoo/utils/../lib/cuckoo/core/plugins.py", line 414, in run
    result = sig.on_call(call, proc)
  File "/opt/cuckoo/utils/../modules/signatures/CAPE.py", line 527, in on_call
    ThreadCreationFlags = int(self.get_raw_argument(call, "CreateFlags"), 16)
TypeError: int() can't convert non-string with explicit base

kevoreilly · 2018-07-27T15:01:44Z

I'm confused - you seem to be getting the errors whether it's "CreateFlags" or "CreationFlags". The hook code for NtCreateThreadEx is in https://github.com/ctxis/capemon/blob/capemon/hook_thread.c and currently has "CreateFlags" which should correlate with the signature.

enzok · 2018-07-27T15:42:02Z

i verified md5 values for the CAPE DLLs and they match your latest build. Verified I have the latest Cape.py. What else can I do to troubleshoot?

kevoreilly · 2018-07-27T15:50:26Z

Can you check the behavioural logs - search for the NtCreateThreadEx calls and see whether they are listed with 'CreateFlags' or 'CreationFlags' as argument.

enzok · 2018-07-27T16:00:05Z

LOL. I was doing that as you were commenting.

Looks like the correct call argument. So the hook is working. Maybe something with parsing the value?

{
                        "category": "threading",
                        "parentcaller": "0x00000000",
                        "return": "0x00000000",
                        "timestamp": "2018-07-27 10:35:07,734",
                        "caller": "0x00000000",
                        "thread_id": "2592",
                        "repeated": 0,
                        "api": "NtCreateThreadEx",
                        "status": true,
                        "arguments": [
                            {
                                "name": "ThreadHandle",
                                "value": "0x00000258"
                            },
                            {
                                "name": "ProcessHandle",
                                "value": "0xffffffff"
                            },
                            {
                                "name": "CreateFlags",
                                "value": "0x00000003"
                            },
                            {
                                "name": "StartAddress",
                                "value": "0x77c42e65"
                            }
                        ],
                        "id": 377
                    },

And...

                    {
                        "category": "threading",
                        "parentcaller": "0x13fcc1ff9",
                        "return": "0x00000000",
                        "timestamp": "2018-07-27 10:35:30,510",
                        "caller": "0x13fcc1a14",
                        "thread_id": "2120",
                        "repeated": 0,
                        "api": "NtCreateThreadEx",
                        "status": true,
                        "arguments": [
                            {
                                "name": "ThreadHandle",
                                "value": "0x0000013c"
                            },
                            {
                                "name": "ProcessHandle",
                                "value": "0xffffffffffffffff"
                            },
                            {
                                "name": "CreateFlags",
                                "value": "0x00000003"
                            },
                            {
                                "name": "StartAddress",
                                "value": "0x77a2aef0"
                            }
                        ],
                        "id": 50
                    },

And...

                    {
                        "category": "threading",
                        "parentcaller": "0x00411e81",
                        "return": "0x00000000",
                        "timestamp": "2018-07-27 10:36:12,817",
                        "caller": "0x004095a9",
                        "thread_id": "276",
                        "repeated": 0,
                        "api": "NtCreateThreadEx",
                        "status": true,
                        "arguments": [
                            {
                                "name": "ThreadHandle",
                                "value": "0x00000134"
                            },
                            {
                                "name": "ProcessHandle",
                                "value": "0xffffffff"
                            },
                            {
                                "name": "CreateFlags",
                                "value": "0x00000003"
                            },
                            {
                                "name": "StartAddress",
                                "value": "0x77c42e65"
                            }
                        ],
                        "id": 558
                    },

                {
                    "category": "threading",
                    "parentcaller": "0xff7a3a19",
                    "return": "0x00000000",
                    "timestamp": "2018-07-27 10:36:24,938",
                    "caller": "0xff7a354d",
                    "thread_id": "2644",
                    "repeated": 0,
                    "api": "NtCreateThreadEx",
                    "status": true,
                    "arguments": [
                        {
                            "name": "ThreadHandle",
                            "value": "0x000000dc"
                        },
                        {
                            "name": "ProcessHandle",
                            "value": "0xffffffffffffffff"
                        },
                        {
                            "name": "CreateFlags",
                            "value": "0x00000003"
                        },
                        {
                            "name": "StartAddress",
                            "value": "0x77a2aef0"
                        }
                    ],
                    "id": 21
                },

And...

                {
                    "category": "threading",
                    "parentcaller": "0x00403cd3",
                    "return": "0x00000000",
                    "timestamp": "2018-07-27 10:37:32,939",
                    "caller": "0x00407810",
                    "thread_id": "628",
                    "repeated": 0,
                    "api": "NtCreateThreadEx",
                    "status": true,
                    "arguments": [
                        {
                            "name": "ThreadHandle",
                            "value": "0x00000118"
                        },
                        {
                            "name": "ProcessHandle",
                            "value": "0xffffffff"
                        },
                        {
                            "name": "CreateFlags",
                            "value": "0x00000003"
                        },
                        {
                            "name": "StartAddress",
                            "value": "0x77c42e65"
                        }
                    ],
                    "id": 66
                },

And...
```                    {
                        "category": "threading",
                        "parentcaller": "0x00000000",
                        "return": "0x00000000",
                        "timestamp": "2018-07-27 10:34:24,568",
                        "caller": "0x00000000",
                        "thread_id": "2368",
                        "repeated": 0,
                        "api": "NtCreateThreadEx",
                        "status": true,
                        "arguments": [
                            {
                                "name": "ThreadHandle",
                                "value": "0x000001d0"
                            },
                            {
                                "name": "ProcessHandle",
                                "value": "0xffffffff"
                            },
                            {
                                "name": "CreateFlags",
                                "value": "0x00000003"
                            },
                            {
                                "name": "StartAddress",
                                "value": "0x77c42e65"
                            }
                        ],
                        "id": 367
                    },

enzok · 2018-07-27T16:35:30Z

Should the method here be get_argument instead of get_raw_argument?

enzok · 2018-07-27T16:53:10Z

Ignore my last comment.

I changed the base and it seems to have fixed the issue (16 to 0):

ThreadCreationFlags = int(self.get_raw_argument(call, "CreateFlags"), 0)

kevoreilly · 2018-07-27T16:59:10Z

Damn this was my fault! Sorry about that, just pushed the fix. Thanks for your help.

enzok · 2018-07-27T17:11:01Z

Glad to help. I'll close this out unless you want me to wait until you push the Ursnif update.

kevoreilly · 2018-07-31T09:45:09Z

I'll close this now but will try and get the Ursnif update published soon.

Increase severity on registry PE

kevoreilly closed this as completed Jul 31, 2018

kevoreilly added a commit that referenced this issue Aug 22, 2019

Merge pull request #56 from kevross33/patch-57

5aa5b74

Increase severity on registry PE

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Signature Errors with latest commits #56

Signature Errors with latest commits #56

enzok commented Jul 10, 2018

kevoreilly commented Jul 10, 2018

enzok commented Jul 10, 2018

redsand commented Jul 10, 2018

kevoreilly commented Jul 10, 2018

kevoreilly commented Jul 10, 2018

redsand commented Jul 10, 2018 via email

enzok commented Jul 23, 2018 •

edited

kevoreilly commented Jul 23, 2018

enzok commented Jul 24, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

enzok commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 31, 2018

Signature Errors with latest commits #56

Signature Errors with latest commits #56

Comments

enzok commented Jul 10, 2018

kevoreilly commented Jul 10, 2018

enzok commented Jul 10, 2018

redsand commented Jul 10, 2018

kevoreilly commented Jul 10, 2018

kevoreilly commented Jul 10, 2018

redsand commented Jul 10, 2018 via email

enzok commented Jul 23, 2018 • edited

kevoreilly commented Jul 23, 2018

enzok commented Jul 24, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

enzok commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 27, 2018

enzok commented Jul 27, 2018

kevoreilly commented Jul 31, 2018

enzok commented Jul 23, 2018 •

edited