Dropped files not gathering all dropped files. #1672
Comments
|
This is something that needs fixing - I would definitely expect to see downloaded files appear in dropped files. Are you able to elaborate by what mechanism they are downloaded/written to disk? For example using Note the |
|
If I were to browse to any URL and download a file, that file won't appear in the dropped file section. Sounds like an error in my setup by what you've mentioned. |
|
You haven't given me much detail! It could have been a malware sample downloading, not a browser. Now I have to ask which browser. Please supply more information in your issues as per the template, such as browser version, os, example url etc so that I can recreate your issue exactly. |
|
I apologize, in my initial post I didn't actually think this was an issue so I did not provide as much information. Here is my setup: CAPE:Running on Ubuntu 22.04. (Updated last week Monday) Analysis Machines:Browser: Microsoft Edge 114.0.1823.82 Additionally, I have confirmed that dropped files by other means (such as excel VBA code) show up in the dropped files section. This behavior is consistent in both viewing the CAPE site and under the /analyses/###/ page. If any of this behavior does not sound uncommon for a CAPE installation - then I have ideas as our infrastructure is somewhat unique. However I haven't changed anything about the core processing functions or modules imported within an analysis itself. |
|
This is a browser-specific issue caused by the fact that it is no longer possible for cape to fully monitor all browser processes (particularly 'sandboxed' processes) due to their internal security and complexity. The current solution is to selectively monitor only certain browser child processes, but this is still a young idea and may need further work to tackle issues such as this. I will need to research which child processes does the downloading (per browser family) and ensure that process is monitored with the relevant hooks active. |
|
Thank you @kevoreilly, I can put some time into this during this week as well and see if I find a work around. Is this something other users have noticed? I could downgrade to an older version of Edge - something I was already looking at anyway because of another post I saw on here mentioning that newer versions of Edge crash. |
|
If you are willing to invest time then I will be grateful as it is a scarce commodity for me. What I would first of all like to establish is: which process is writing the file to disk? The quickest way to work this out is probably to use Sysinternal Process Monitor to catch the file being created - if you can do this is will save me some time. |
|
Hello Kev I have some time to revisit this issue. I would like to understand the dropped file collection mechanism better but have had some trouble finding where this part of analysis is handled. What scripts handle this (either URL or XLS, just so I can understand it)? |
|
Hi Carson - sorry not to reply earlier - only just spotted your most recent message. The mechanism for collecting dropped files starts with the file-related API hooks such as So to tackle this properly I will need to prevent the monitor from assigning the So if you have time, a capture of the command line or other identifying characteristics of the edge process responsible for writing the downloads to disk would be useful. I would think by far the best way of gathering this information is use of Sysinternals Process Monitor. |
|
Thanks Kev I will try and look into |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
About accounts on capesandbox.com
This is open source and you are getting free support so be friendly!
Prerequisites
Please answer the following questions for yourself before submitting an issue.
Expected Behavior
Easy access to all files found within an analysis.
Current Behavior
Currently, our instance will detect dropped files that actually dropped on disk, but doesn't detect or show files that are downloaded via URL.
This isn't necessarily a bug, as dropped files does what it is supposed to do - detect dropped files. This is more of a question / comment, is there an easier way to show downloaded files rather then search through the network pcap?
The text was updated successfully, but these errors were encountered: