Package modules :: Package auxiliary :: Module disguise
[hide private]
[frames] | no frames]

Source Code for Module modules.auxiliary.disguise

  1  # Copyright (C) 2010-2013 Claudio Guarnieri. 
  2  # Copyright (C) 2014-2016 Cuckoo Foundation. 
  3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
  4  # See the file 'docs/LICENSE' for copying permission. 
  5   
  6  import itertools 
  7  import logging 
  8  import random 
  9   
 10  from _winreg import HKEY_LOCAL_MACHINE, REG_SZ, REG_MULTI_SZ, REG_BINARY 
 11   
 12  from lib.common.abstracts import Auxiliary 
 13  from lib.common.rand import random_integer, random_string 
 14  from lib.common.registry import rename_regkey, regkey_exists 
 15  from lib.common.registry import set_regkey, query_value 
 16   
 17  log = logging.getLogger(__name__) 
 18   
19 -class Disguise(Auxiliary):
20 """Disguise the analysis environment.""" 21 22 HDD_IDENTIFIERS = [ 23 "ST9160411AS", 24 ] 25 26 HDD_PATHS = [ 27 "IDE\\DiskST9160411AS_____________________________LV14____", 28 "IDE\\DiskKINGSTON_SV300S_________________________541A____", 29 ] 30 31 CDROM_IDENTIFIERS = [ 32 "HL-DT-ST RW/DVD MU10N", 33 ] 34 35 SYSTEM_BIOS_DATES = [ 36 "03/11/11", 37 "01/09/09", 38 ] 39 40 SYSTEM_BIOS_VERSIONS = [ 41 ["LENOVO - 3220", "Ver 1.00PARTTBL("], 42 ["LENOVO - 2020", "Ver 1.00PARTTBLX"], 43 ] 44 45 VIDEO_BIOS_DATES = [ 46 "02/10/20", 47 "06/12/20", 48 ] 49 50 VIDEO_BIOS_VERSIONS = [ 51 ["Hardware Version 0.0", "PARTTBLX"], 52 ] 53 54 BIOS_VERSIONS = [ 55 "6FET56WW (2.02 )", 56 "7UET92WW (3.22 )", 57 ] 58 59 SYSTEM_MANUFACTURERS = [ 60 "LENOVO", 61 ] 62 63 SYSTEM_PRODUCTNAMES = [ 64 "64755N2", 65 "2241W2U", 66 ] 67
68 - def change_productid(self):
69 """Randomizes Windows ProductId. 70 The Windows ProductId is occasionally used by malware 71 to detect public setups of Cuckoo, e.g., Malwr.com. 72 """ 73 value = "{0}-{1}-{2}-{3}".format(random_integer(5), random_integer(3), 74 random_integer(7), random_integer(5)) 75 76 set_regkey(HKEY_LOCAL_MACHINE, 77 "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", 78 "ProductId", REG_SZ, value)
79
80 - def patch_scsi_identifiers(self):
81 types = { 82 "DiskPeripheral": self.HDD_IDENTIFIERS, 83 "CdRomPeripheral": self.CDROM_IDENTIFIERS, 84 } 85 86 for row in itertools.product([0, 1, 2, 3], [0, 1, 2, 3], [0, 1, 2, 3], [0, 1, 2, 3]): 87 type_ = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row, "Type") 88 value = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row, "Identifier") 89 if not type_ or not value: 90 continue 91 92 value = value.lower() 93 if "vbox" in value or "vmware" in value or "qemu" in value or "virtual" in value: 94 if type_ in types: 95 new_value = random.choice(types[type_]) 96 else: 97 log.warning("Unknown SCSI type (%s), disguising it with a random string", type_) 98 new_value = random_string(len(value)) 99 100 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row, 101 "Identifier", REG_SZ, new_value)
102
103 - def patch_bios(self):
104 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "SystemBiosDate", REG_SZ, random.choice(self.SYSTEM_BIOS_DATES)) 105 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "SystemBiosVersion", REG_MULTI_SZ, random.choice(self.SYSTEM_BIOS_VERSIONS)) 106 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "VideoBiosDate", REG_SZ, random.choice(self.VIDEO_BIOS_DATES)) 107 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "VideoBiosVersion", REG_MULTI_SZ, random.choice(self.VIDEO_BIOS_VERSIONS))
108
109 - def patch_acpi(self):
110 # TODO This should be improved, but for now may suffice. 111 keywords = { 112 "VBOX": "LNVO", 113 "vbox": "lnvo", 114 "VirtualBox": "LENOVOTP", 115 "innotek GmbH": "", 116 } 117 118 regkeys = [ 119 ["SYSTEM\\CurrentControlSet\\Services\\mssmbios\\Data", "AcpiData"], 120 ["SYSTEM\\ControlSet001\\Services\\mssmbios\\Data", "AcpiData"], 121 122 ["SYSTEM\\CurrentControlSet\\Services\\mssmbios\\Data", "SMBiosData"], 123 ["SYSTEM\\ControlSet001\\Services\\mssmbios\\Data", "SMBiosData"], 124 ] 125 126 for regkey, key in regkeys: 127 value = query_value(HKEY_LOCAL_MACHINE, regkey, key) 128 if value is None: 129 continue 130 131 for k, v in keywords.items(): 132 value = value.replace(k, v) 133 134 set_regkey(HKEY_LOCAL_MACHINE, regkey, key, REG_BINARY, value) 135 136 if regkey_exists(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__"): 137 rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__", "LENOVO") 138 rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\FADT\\VBOX__", "LENOVO") 139 rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\RSDT\\VBOX__", "LENOVO")
140
141 - def patch_processor(self):
142 keywords = { 143 "QEMU Virtual CPU version 2.0.0": "Intel(R) Core(TM) i7 CPU @3GHz", 144 } 145 146 for idx in xrange(32): 147 value = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" % idx, "ProcessorNameString") 148 if value is None: 149 continue 150 151 for k, v in keywords.items(): 152 value = value.replace(k, v) 153 154 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" % idx, 155 "ProcessorNameString", REG_SZ, value)
156
157 - def patch_manufacturer(self):
158 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation", 159 "BIOSVersion", REG_SZ, random.choice(self.BIOS_VERSIONS)) 160 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation", 161 "BIOSReleaseDate", REG_SZ, random.choice(self.SYSTEM_BIOS_DATES)) 162 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation", 163 "SystemManufacturer", REG_SZ, random.choice(self.SYSTEM_MANUFACTURERS)) 164 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation", 165 "SystemProductName", REG_SZ, random.choice(self.SYSTEM_PRODUCTNAMES))
166
167 - def patch_hdd_path(self):
168 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Services\\Disk\\Enum", 169 "0", REG_SZ, random.choice(self.HDD_PATHS))
170
171 - def start(self):
172 self.change_productid() 173 self.patch_scsi_identifiers() 174 self.patch_bios() 175 self.patch_acpi() 176 self.patch_processor() 177 self.patch_manufacturer() 178 self.patch_hdd_path() 179 return True
180