1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
11
12
14 """PowerShell analysis package."""
15
17 paths = [
18 os.path.join(os.getenv("SystemRoot"), "system32", "WindowsPowerShell", "v1.0", "powershell.exe"),
19 os.path.join(os.getenv("SystemRoot"), "system32", "WindowsPowerShell", "v2.0", "powershell.exe"),
20 os.path.join(os.getenv("SystemRoot"), "system32", "WindowsPowerShell", "v3.0", "powershell.exe")
21 ]
22
23 for path in paths:
24 if os.path.exists(path):
25 return path
26
27 return None
28
30 powershell = self.get_path()
31 if not powershell:
32 raise CuckooPackageError("Unable to find any PowerShell executable available")
33
34 dll = self.options.get("dll", None)
35 free = self.options.get("free", False)
36 suspended = True
37 if free:
38 suspended = False
39
40 args = "-NoProfile -ExecutionPolicy unrestricted -File \"{0}\"".format(path)
41
42 p = Process()
43 if not p.execute(path=powershell, args=args, suspended=suspended):
44 raise CuckooPackageError("Unable to execute initial PowerShell process, analysis aborted")
45
46 if not free and suspended:
47 p.inject(dll)
48 p.resume()
49 return p.pid
50 else:
51 return None
52
55
57 if self.options.get("procmemdump", False):
58 for pid in self.pids:
59 p = Process(pid=pid)
60 p.dump_memory()
61
62 return True
63