kevoreilly/CAPEv2

Human interactions are not working properly

artist740 opened this issue · 7 comments

artist740 commented

About accounts on capesandbox.com

  • Issues isn't the way to ask for account activation. Ping capesandbox in Twitter with your username

This is open source and you are getting free support so be friendly!

Prerequisites

Please answer the following questions for yourself before submitting an issue.

  • [ + ] I am running the latest version
  • [ + ] I did read the README!
  • [ + ] I checked the documentation and found no answer
  • [ + ] I checked to make sure that this issue has not already been filed
  • [ + ] I'm reporting the issue to the correct repository (for multi-repository projects)
  • [ + ] I have read and checked all configs (with all optional parts)

Expected Behavior

Human interactions should press the buttons "next", "ok", etc. if they are available while analyzing some installers.

Current Behavior

Currently, the buttons are not clicked.

Steps to Reproduce

Please provide detailed steps for reproducing the issue.

  1. Download standard cape2.sh;
  2. Download NordVPN installer or Sublime Text 3 installer;
  3. Try to make an analysis.

Context

Hello, I'm having an issue with human interactions during file analysis. For the testing I am uploading an installer of different applications for analysis. The installer opens the initial page and waits for "Next" or "OK" to be pressed. But the human.py script isn't clicking them, it just moves the mouse. I thought it might be a case sensitivity issue in the human.py file, so I tried duplicating "Next" and "OK" with capital letters, but that didn't help.

Can you please suggest how I can check why it's not working as expected?

Thanks in advance.

1 1
1_sublime_text.webm
2_nordvpn.webm

doomedraven commented

Maybe they use MUI which doesn't expose API so humen can't see those buttons

artist740 commented

Maybe you have some samples on which I can test the right working scenario? Because I have already tried 15+ different installers, and it is not working. That is why I thought that human.py are not loaded correctly or blocked at some point. Because if you check the videos, the mouse stops moving when the installer opens.

doomedraven commented

i don't have any samples

artist740 commented

Got it. Will try to find out then. Do human.py file injects into Windows 10 when the analysis starts or it operates in host machine through KVM somehow?

doomedraven commented

is inside of the windows vm

artist740 commented

Got it, thanks

doomedraven commented

btw closing as your files are not related to malware, if you find this problem with real malware feel free to reopen

  • 👍1