Skip to content
This repository has been archived by the owner on Apr 26, 2021. It is now read-only.

Implement clean long-term analysis #708

Open
botherder opened this issue Dec 22, 2015 · 3 comments
Open

Implement clean long-term analysis #708

botherder opened this issue Dec 22, 2015 · 3 comments
Assignees
Milestone

Comments

@botherder
Copy link
Member

Currently analyses have soft and hard timeouts and they are cleanly or abruptly terminated in case either of those timeouts are hit. However, in some contexts we might want to execute the analysis for an indeterminate amount of time.

In order to do so we need:

  • Set a flag in existing Task table or create a new Commands table to allow the user to insert a stop instructions associated to a task ID
  • Have the Analyzer poll the ResultServer asking for pending commands (this can be used for other purposes too)
  • Have the GuestManager re-create a timeout after the stop command has been issued (perhaps 10 minutes after it), in case the Analyzer isn't able to terminate cleanly anymore.
@botherder botherder self-assigned this Dec 22, 2015
@botherder botherder added this to the 2.0 milestone Dec 22, 2015
@KillerInstinct
Copy link
Contributor

Also it should be noted that longer analysis times means more API logs, and this you may run into the MongoDB document size limit more often with this type of analysis. (I use cuckoo to run 30min analysis on some samples, and ran into this frequently)

@botherder
Copy link
Member Author

That's for sure, but perhaps in this case we can have a dedicate DLL that only monitors very basic APIs (create file, create process, write registry key) and nothing else.

@jbremer
Copy link
Member

jbremer commented Dec 22, 2015

As this has already been implemented in a slightly different form, some takeaway features may be obtained from https://github.com/jbremer/longcuckoo.
For a limited set of behavioral results we could create a monitoring mode in the new monitor which, as @botherder mentioned, would only look at very basic functionality (instead of all 300+ functions).
An additional feature request from my side for longer term analysis is RDP/VNC integration of the analysis VM into the Cuckoo web interface.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants
@botherder @jbremer @KillerInstinct and others