spender-sandbox/cuckoomon-modified

lots of "Unable to hook" status on Windows 7 Guest OS

MerX1030 opened this issue · 6 comments

MerX1030 commented

can't seem to find what might be the error.
hooks work fine on Windows XP Guest OS:
MD5 1929d5db340aac125c3dcbd4bb44202e
SHA1 0ab64275390b2deaf983d751f77f0f77014ef49a

spender-sandbox commented

Can you show me the analysis.log and give the hash of the DLLs involved?

MerX1030 commented

Here are the logs and DLLs involved. (password is "cuckoo")
cuckoo_logs.zip

In Windows XP there is a successful call to SHGetFolderPathW that was logged.
This call in Windows 7 was not logged and the logging ended prematurely.

spender-sandbox commented

The analysis.log wasn't included in the zip, can you show me that? It's the only thing that would display which hooks failed.

-Brad

spender-sandbox commented

And these are pristine VM images? You didn't install an AV product into them or something did you? I don't see any reason for the hooks to have failed.

-Brad

MerX1030 commented

Oooops. Sorry, my bad! Seems like I used the VM image with Endpoint Forensics.
Now closing this case.