CAPEv2 icon indicating copy to clipboard operation
CAPEv2 copied to clipboard
verified publisher icon kevoreilly

failing unserviceable task

Open MrFastDie opened this issue 2 months ago • 3 comments

About accounts on capesandbox.com

  • Issues isn't the way to ask for account activation. Ping capesandbox in Twitter with your username

This is open source and you are getting free support so be friendly!

Prerequisites

Please answer the following questions for yourself before submitting an issue.

  • [x] I am running the latest version
  • [x] I did read the README!
  • [x] I checked the documentation and found no answer
  • [x] I checked to make sure that this issue has not already been filed
  • [x] I'm reporting the issue to the correct repository (for multi-repository projects)
  • [x] I have read and checked all configs (with all optional parts)
  • [x] Asked and no solution about my issue with deepwiki

Expected Behavior

When submitting a file, it should run.

Current Behavior

It fails immediately with Task #17: Failing unserviceable task - no directory for this task has been created.

Failure Information (for bugs)

2025-10-25 10:37:19,936 [lib.cuckoo.core.machinery_manager] INFO: Using MachineryManager[kvm] with max_machines_count=10
2025-10-25 10:37:19,936 [lib.cuckoo.core.scheduler] INFO: Creating scheduler with max_analysis_count=unlimited
2025-10-25 10:37:19,968 [lib.cuckoo.common.abstracts] DEBUG: Getting status for analytics01
2025-10-25 10:37:19,985 [lib.cuckoo.core.machinery_manager] INFO: Loaded 1 machine
2025-10-25 10:37:20,036 [lib.cuckoo.core.machinery_manager] INFO: max_vmstartup_count for BoundedSemaphore = 5
2025-10-25 10:37:20,038 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks
2025-10-25 10:37:50,412 [lib.cuckoo.core.scheduler] INFO: Task #17: Failing unserviceable task

Steps to Reproduce

Please provide detailed steps for reproducing the issue.

  1. Set up CAPE as per docs
  2. Install guacamole
  3. Set up nginx
  4. Spin up test with
  • Interactive desktop
  • Manual detonation (Must be used with Interactive desktop!)
  1. Do anything
  2. Tried to hit on Finish task or whatever it was called - nothing happened after this
  3. Power off VM through windows itself
  4. Task did not finish so restarted everything
  5. Now everything fails immediately

Context

Nothing is really special about the setup...

Question Answer
Git commit e593cbeb6ce268e3a933cf81ee92e8dcbac9106b
OS version Ubuntu 24.04.3 LTS

Failure Logs

tail log/cuckoo.log
2025-10-25 10:49:31,461 [lib.cuckoo.core.machinery_manager] INFO: Loaded 1 machine
2025-10-25 10:49:31,520 [lib.cuckoo.core.machinery_manager] INFO: max_vmstartup_count for BoundedSemaphore = 5
2025-10-25 10:49:31,522 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks
2025-10-25 10:49:57,249 [lib.cuckoo.core.scheduler] INFO: received signal 'SIGTERM', waiting for remaining analysis to finish before stopping
2025-10-25 10:50:02,060 [lib.cuckoo.core.machinery_manager] INFO: Using MachineryManager[kvm] with max_machines_count=10
2025-10-25 10:50:02,060 [lib.cuckoo.core.scheduler] INFO: Creating scheduler with max_analysis_count=unlimited
2025-10-25 10:50:02,102 [lib.cuckoo.core.machinery_manager] INFO: Loaded 1 machine
2025-10-25 10:50:02,144 [lib.cuckoo.core.machinery_manager] INFO: max_vmstartup_count for BoundedSemaphore = 5
2025-10-25 10:50:02,146 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks
2025-10-25 10:50:11,277 [lib.cuckoo.core.scheduler] INFO: Task #18: Failing unserviceable task

The process.log does not even contain the latest events

tail log/process.log
2025-10-25 08:42:04,210 [Task 3] [dev_utils.mongodb] INFO: attempting to delete calls for 1 tasks
2025-10-25 08:42:04,367 [root] INFO: Reports generation completed for Task #3
2025-10-25 08:53:29,770 [root] INFO: Processing analysis data for Task #7
2025-10-25 08:53:33,552 [Task 7] [lib.cuckoo.common.integrations.virustotal] ERROR: VT: Request failed
2025-10-25 08:53:34,335 [Task 7] [lib.cuckoo.common.integrations.virustotal] ERROR: VT: Request failed
2025-10-25 08:53:47,364 [Task 7] [dev_utils.mongodb] INFO: attempting to delete calls for 1 tasks
2025-10-25 08:53:47,732 [root] INFO: Reports generation completed for Task #7
2025-10-25 09:11:03,338 [root] INFO: Processing analysis data
2025-10-25 10:01:57,969 [root] INFO: Processing analysis data
2025-10-25 10:27:56,538 [root] INFO: Processing analysis data

Analyses dir is also not containing anything

ls storage/analyses/
1  10  2  3  7  latest

Do you have any other ideas where I can find logs etc?

I am using kvm:

cat conf/kvm.conf
[kvm]
# Specify a comma-separated list of available machines to be used. For each
# specified ID you have to define a dedicated section containing the details
# on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3)
machines = analytics01

interface = vnet0
# To connect to local or remote host
dsn = qemu:///system

# To allow copy & paste. For details see example below
[analytics01]
label = analytics01
platform = windows
ip = 192.168.122.188
arch = x86
# tags = winxp,acrobat_reader_6
snapshot = Start_No_Win_Updates
# resultserver_ip = 192.168.122.101
# reserved = no

MrFastDie avatar Oct 25 '25 10:10 MrFastDie

iFace vnet0? Should be virbr1(host only) you set mess with nat and something else Arch is x86. Is your sample x64?

There lack of details about sample at least

El sáb, 25 oct 2025, 12:55, Daniel @.***> escribió:

MrFastDie created an issue (kevoreilly/CAPEv2#2730) https://github.com/kevoreilly/CAPEv2/issues/2730 About accounts on capesandbox.com

This is open source and you are getting free support so be friendly! Prerequisites

Please answer the following questions for yourself before submitting an issue.

  • I am running the latest version
  • I did read the README!
  • I checked the documentation and found no answer
  • I checked to make sure that this issue has not already been filed
  • I'm reporting the issue to the correct repository (for multi-repository projects)
  • I have read and checked all configs (with all optional parts)
  • Asked and no solution about my issue with deepwiki https://deepwiki.com/kevoreilly/CAPEv2

Expected Behavior

When submitting a file, it should run. Current Behavior

It fails immediately with Task #17: Failing unserviceable task - no directory for this task has been created. Failure Information (for bugs)

2025-10-25 10:37:19,936 [lib.cuckoo.core.machinery_manager] INFO: Using MachineryManager[kvm] with max_machines_count=10 2025-10-25 10:37:19,936 [lib.cuckoo.core.scheduler] INFO: Creating scheduler with max_analysis_count=unlimited 2025-10-25 10:37:19,968 [lib.cuckoo.common.abstracts] DEBUG: Getting status for analytics01 2025-10-25 10:37:19,985 [lib.cuckoo.core.machinery_manager] INFO: Loaded 1 machine 2025-10-25 10:37:20,036 [lib.cuckoo.core.machinery_manager] INFO: max_vmstartup_count for BoundedSemaphore = 5 2025-10-25 10:37:20,038 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks 2025-10-25 10:37:50,412 [lib.cuckoo.core.scheduler] INFO: Task #17: Failing unserviceable task

Steps to Reproduce

Please provide detailed steps for reproducing the issue.

  1. Set up CAPE as per docs
  2. Install guacamole
  3. Set up nginx
  4. Spin up test with
  • Interactive desktop
  • Manual detonation (Must be used with Interactive desktop!)
  1. Do anything
  2. Tried to hit on Finish task or whatever it was called - nothing happened after this
  3. Power off VM through windows itself
  4. Task did not finish so restarted everything
  5. Now everything fails immediately

Context

Nothing is really special about the setup... Question Answer Git commit e593cbeb6ce268e3a933cf81ee92e8dcbac9106b OS version Ubuntu 24.04.3 LTS Failure Logs

tail log/cuckoo.log 2025-10-25 10:49:31,461 [lib.cuckoo.core.machinery_manager] INFO: Loaded 1 machine 2025-10-25 10:49:31,520 [lib.cuckoo.core.machinery_manager] INFO: max_vmstartup_count for BoundedSemaphore = 5 2025-10-25 10:49:31,522 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks 2025-10-25 10:49:57,249 [lib.cuckoo.core.scheduler] INFO: received signal 'SIGTERM', waiting for remaining analysis to finish before stopping 2025-10-25 10:50:02,060 [lib.cuckoo.core.machinery_manager] INFO: Using MachineryManager[kvm] with max_machines_count=10 2025-10-25 10:50:02,060 [lib.cuckoo.core.scheduler] INFO: Creating scheduler with max_analysis_count=unlimited 2025-10-25 10:50:02,102 [lib.cuckoo.core.machinery_manager] INFO: Loaded 1 machine 2025-10-25 10:50:02,144 [lib.cuckoo.core.machinery_manager] INFO: max_vmstartup_count for BoundedSemaphore = 5 2025-10-25 10:50:02,146 [lib.cuckoo.core.scheduler] INFO: Waiting for analysis tasks 2025-10-25 10:50:11,277 [lib.cuckoo.core.scheduler] INFO: Task #18: Failing unserviceable task

The process.log does not even contain the latest events

tail log/process.log 2025-10-25 08:42:04,210 [Task 3] [dev_utils.mongodb] INFO: attempting to delete calls for 1 tasks 2025-10-25 08:42:04,367 [root] INFO: Reports generation completed for Task #3 2025-10-25 08:53:29,770 [root] INFO: Processing analysis data for Task #7 2025-10-25 08:53:33,552 [Task 7] [lib.cuckoo.common.integrations.virustotal] ERROR: VT: Request failed 2025-10-25 08:53:34,335 [Task 7] [lib.cuckoo.common.integrations.virustotal] ERROR: VT: Request failed 2025-10-25 08:53:47,364 [Task 7] [dev_utils.mongodb] INFO: attempting to delete calls for 1 tasks 2025-10-25 08:53:47,732 [root] INFO: Reports generation completed for Task #7 2025-10-25 09:11:03,338 [root] INFO: Processing analysis data 2025-10-25 10:01:57,969 [root] INFO: Processing analysis data 2025-10-25 10:27:56,538 [root] INFO: Processing analysis data

Analyses dir is also not containing anything

ls storage/analyses/ 1 10 2 3 7 latest

Do you have any other ideas where I can find logs etc?

I am using kvm:

cat conf/kvm.conf [kvm]# Specify a comma-separated list of available machines to be used. For each# specified ID you have to define a dedicated section containing the details# on the respective machine. (E.g. cuckoo1,cuckoo2,cuckoo3) machines = analytics01

interface = vnet0# To connect to local or remote host dsn = qemu:///system

To allow copy & paste. For details see example below

[analytics01] label = analytics01 platform = windows ip = 192.168.122.188 arch = x86# tags = winxp,acrobat_reader_6 snapshot = Start_No_Win_Updates# resultserver_ip = 192.168.122.101# reserved = no

— Reply to this email directly, view it on GitHub https://github.com/kevoreilly/CAPEv2/issues/2730, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAOFH372PKTZBKF5YLYE4BD3ZNJK7AVCNFSM6AAAAACKF7FCE6VHI2DSMVQWIX3LMV43ASLTON2WKOZTGU2TEMZSHAZTCNY . You are receiving this because you are subscribed to this thread.Message ID: @.***>

doomedraven avatar Oct 25 '25 13:10 doomedraven

Ok, thanks, I got it running - seems that I got confused about x86 and x64 again... However, strange that it does not work.

One problem persists though: When using Interactive Session - the End Session above the VNC does not end the session. Although I do get a 200 from the network response, the session only ends when I terminate the VM.

However, just powering off the VM does not always lead CAPE to realize that the session ended, so often the Analyze failed which is kind of bad because we need the results from working with a program.

MrFastDie avatar Oct 26 '25 05:10 MrFastDie

this should solve your issue https://github.com/kevoreilly/CAPEv2/pull/2790, in case you can test

doomedraven avatar Dec 14 '25 20:12 doomedraven