1
2
3
4
5 import logging
6 import os
7 import random
8
9 from lib.common.abstracts import Auxiliary
10 from lib.common.defines import SHELL32, SHARD_PATHA
11 from lib.common.exceptions import CuckooError
12 from lib.common.rand import random_string
13 from lib.common.registry import set_regkey_full
14
15 log = logging.getLogger(__name__)
16
18 """Populates the Desktop with recent files in order to combat recent
19 anti-sandbox measures."""
20
21 extensions = [
22 "txt", "rtf", "doc", "docx", "docm", "ppt", "pptx",
23 ]
24
26 if "USERPROFILE" not in os.environ:
27 raise CuckooError(
28 "Unable to populate recent files as the USERPROFILE "
29 "environment variable is missing."
30 )
31
32 desktop = os.path.join(os.environ["USERPROFILE"], "Desktop")
33
34 for idx in xrange(random.randint(5, 10)):
35 filename = random_string(10, random.randint(10, 20))
36 ext = random.choice(self.extensions)
37 filepath = os.path.join(desktop, "%s.%s" % (filename, ext))
38 open(filepath, "wb").write(os.urandom(random.randint(30, 999999)))
39
40 SHELL32.SHAddToRecentDocs(SHARD_PATHA, filepath)
41
42 set_regkey_full(
43 "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\12.0\\"
44 "Word\\File MRU\\Item %d" % (idx + 1),
45 "REG_SZ", "[F00000000][T01D1C40000000000]*%s" % filepath,
46 )
47