Comments (5)
It sounds like some options are being dropped off the VMRUN command line when calling the VM. Can you run with the 'debug' (--debug) option set and paste the command lines shown for this error?
from noriben.
PS D:\Users\Pins\Desktop\Noriben-master> python .\NoribenSandbox.py --update --screenshot -t 45 -f .\suspicious_exe.exe --debug
[*] Processing: .\suspicious_exe.exe
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" -T ws revertToSnapshot "D:\Users\user\Documents\VM\win7x64\win7x64.vmx" snap1
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" -T ws start "D:\Users\user\Documents\VM\win7x64\win7x64.vmx"
"C:\Program Files (x86)\VMware\VMware Workstation\vmrun.exe" -gu user -gp copyFileFromHostToGuest "D:\Users\user\Documents\VM\win7x64\win7x64.vmx" ".\suspicious_exe.exe" "C:\\Malware\\malware_suspicious_exe.exe"
Error: Unrecognized command: D:\Users\user\Documents\VM\win7x64\win7x64.vmx
[!] Error trying to copy file to guest. Error 0xffffffff: Unexpected Error
And here is my config
VMX = r'D:\Users\Pins\Documents\VM\win7x64\win7x64.vmx'
# VMX = os.path.expanduser(r'~/VMs/Windows.vmwarevm/Windows.vmx')
VMRUN = vmrun_os['windows']
VM_SNAPSHOT = 'snap1'
VM_USER = 'user'
VM_PASS = ''
noribenPath = 'C:\\\\Users\\\\{}\\\\Desktop\\\\Noriben-master'.format(VM_USER)
guestNoribenPath = '{}\\\\Noriben.py'.format(noribenPath)
procmonConfigPath = '{}\\\\ProcmonConfiguration.pmc'.format(noribenPath)
reportPathStructure = '{}/{}_NoribenReport.zip' # (hostMalwarePath, hostMalwareNameBase)
hostScreenshotPathStructure = '{}/{}.png' # (hostMalwarePath, hostMalwareNameBase)
guestLogPath = 'C:\\\\Noriben_Logs'
guestZipPath = 'C:\\\\Program Files\\\\VMware\\\\VMware Tools\\\\zip.exe'
#guestPythonPath = 'C:\\\\Python27\\\\python.exe'
guestPythonPath = 'C:\\\\Python36-32\\\\python.exe'
hostNoribenPath = os.path.join(os.path.dirname(os.path.abspath(sys.argv[0])), 'Noriben.py')
guestMalwarePath = 'C:\\\\Malware\\\\malware_'
from noriben.
Did you redact out the password, or is it really blank?
If it's really blank, unfortunately VMware requires a password on an account to do any external commands.
If it's redacted out, can you try to run that command directly to get the raw output instead of running it within NoribenSandbox? That is, take all the command lines that you see on the output and just copy/paste them to run them, and see if there are any additional errors displayed on the screen.
from noriben.
Set the password, and now its working perfectly!
Thank you Brian
from noriben.
Good to hear!
It's one of the little things about VMware that I learned the hard way. I'll add a check to the script to ensure it's checked so that this issue is caught in the future. Thanks for letting me know!
from noriben.
Related Issues (20)
- Non-PE File (e.g. Malicious Office Files) Support on Sandbox HOT 3
- Registry lenght exceeded HOT 14
- question regarding procmon.pmc configuration file name and extenstion HOT 1
- How to whitelist System:4 process? HOT 4
- I've kept the ProcmonConfiguration.PMC name because that's what SysInternals has always referred to it as. I don't want people to think that this is using an entirely new file format when they may already have PMC's lying around. HOT 3
- Malware - encrypting the.pml HOT 2
- Chinese characters in log HOT 2
- Noriben can't load the CSVfile made by procmon HOT 13
- Empty text and timeline file generated by Noriben HOT 16
- Pledgie Link HOT 1
- procmon.exe path problem HOT 3
- PML file being encrypted by malware HOT 2
- ValueError: could not convert string to float: '3\xa0256' HOT 14
- I've been playing with this issue for awhile, and apologies for the lengthy delay. It's an issue of the backing file being encrypted, but Procmon does have the ability to use virtual memory for the live data. Do you have a sample that you can test against, or provide hash for so I can test? HOT 10
- New issue - VM running Windows 11 Pro HOT 5
- Exiting with error code: 8: Error creating PML HOT 3
- hashlist and csv creation issues HOT 1
- this issue is back. See below HOT 4
- CLosing Noriben HOT 2
- noriben does not create the text file HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from noriben.