1
2
3
4
5
6 import itertools
7 import logging
8 import random
9
10 from _winreg import HKEY_LOCAL_MACHINE, REG_SZ, REG_MULTI_SZ, REG_BINARY
11
12 from lib.common.abstracts import Auxiliary
13 from lib.common.rand import random_integer, random_string
14 from lib.common.registry import rename_regkey, regkey_exists
15 from lib.common.registry import set_regkey, query_value
16
17 log = logging.getLogger(__name__)
18
20 """Disguise the analysis environment."""
21
22 HDD_IDENTIFIERS = [
23 "ST9160411AS",
24 ]
25
26 HDD_PATHS = [
27 "IDE\\DiskST9160411AS_____________________________LV14____",
28 "IDE\\DiskKINGSTON_SV300S_________________________541A____",
29 ]
30
31 CDROM_IDENTIFIERS = [
32 "HL-DT-ST RW/DVD MU10N",
33 ]
34
35 SYSTEM_BIOS_DATES = [
36 "03/11/11",
37 "01/09/09",
38 ]
39
40 SYSTEM_BIOS_VERSIONS = [
41 ["LENOVO - 3220", "Ver 1.00PARTTBL("],
42 ["LENOVO - 2020", "Ver 1.00PARTTBLX"],
43 ]
44
45 VIDEO_BIOS_DATES = [
46 "02/10/20",
47 "06/12/20",
48 ]
49
50 VIDEO_BIOS_VERSIONS = [
51 ["Hardware Version 0.0", "PARTTBLX"],
52 ]
53
54 BIOS_VERSIONS = [
55 "6FET56WW (2.02 )",
56 "7UET92WW (3.22 )",
57 ]
58
59 SYSTEM_MANUFACTURERS = [
60 "LENOVO",
61 ]
62
63 SYSTEM_PRODUCTNAMES = [
64 "64755N2",
65 "2241W2U",
66 ]
67
69 """Randomizes Windows ProductId.
70 The Windows ProductId is occasionally used by malware
71 to detect public setups of Cuckoo, e.g., Malwr.com.
72 """
73 value = "{0}-{1}-{2}-{3}".format(random_integer(5), random_integer(3),
74 random_integer(7), random_integer(5))
75
76 set_regkey(HKEY_LOCAL_MACHINE,
77 "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
78 "ProductId", REG_SZ, value)
79
81 types = {
82 "DiskPeripheral": self.HDD_IDENTIFIERS,
83 "CdRomPeripheral": self.CDROM_IDENTIFIERS,
84 }
85
86 for row in itertools.product([0, 1, 2, 3], [0, 1, 2, 3], [0, 1, 2, 3], [0, 1, 2, 3]):
87 type_ = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row, "Type")
88 value = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row, "Identifier")
89 if not type_ or not value:
90 continue
91
92 value = value.lower()
93 if "vbox" in value or "vmware" in value or "qemu" in value or "virtual" in value:
94 if type_ in types:
95 new_value = random.choice(types[type_])
96 else:
97 log.warning("Unknown SCSI type (%s), disguising it with a random string", type_)
98 new_value = random_string(len(value))
99
100 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row,
101 "Identifier", REG_SZ, new_value)
102
104 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "SystemBiosDate", REG_SZ, random.choice(self.SYSTEM_BIOS_DATES))
105 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "SystemBiosVersion", REG_MULTI_SZ, random.choice(self.SYSTEM_BIOS_VERSIONS))
106 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "VideoBiosDate", REG_SZ, random.choice(self.VIDEO_BIOS_DATES))
107 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "VideoBiosVersion", REG_MULTI_SZ, random.choice(self.VIDEO_BIOS_VERSIONS))
108
110
111 keywords = {
112 "VBOX": "LNVO",
113 "vbox": "lnvo",
114 "VirtualBox": "LENOVOTP",
115 "innotek GmbH": "",
116 }
117
118 regkeys = [
119 ["SYSTEM\\CurrentControlSet\\Services\\mssmbios\\Data", "AcpiData"],
120 ["SYSTEM\\ControlSet001\\Services\\mssmbios\\Data", "AcpiData"],
121
122 ["SYSTEM\\CurrentControlSet\\Services\\mssmbios\\Data", "SMBiosData"],
123 ["SYSTEM\\ControlSet001\\Services\\mssmbios\\Data", "SMBiosData"],
124 ]
125
126 for regkey, key in regkeys:
127 value = query_value(HKEY_LOCAL_MACHINE, regkey, key)
128 if value is None:
129 continue
130
131 for k, v in keywords.items():
132 value = value.replace(k, v)
133
134 set_regkey(HKEY_LOCAL_MACHINE, regkey, key, REG_BINARY, value)
135
136 if regkey_exists(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__"):
137 rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__", "LENOVO")
138 rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\FADT\\VBOX__", "LENOVO")
139 rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\RSDT\\VBOX__", "LENOVO")
140
142 keywords = {
143 "QEMU Virtual CPU version 2.0.0": "Intel(R) Core(TM) i7 CPU @3GHz",
144 }
145
146 for idx in xrange(32):
147 value = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" % idx, "ProcessorNameString")
148 if value is None:
149 continue
150
151 for k, v in keywords.items():
152 value = value.replace(k, v)
153
154 set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" % idx,
155 "ProcessorNameString", REG_SZ, value)
156
158 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
159 "BIOSVersion", REG_SZ, random.choice(self.BIOS_VERSIONS))
160 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
161 "BIOSReleaseDate", REG_SZ, random.choice(self.SYSTEM_BIOS_DATES))
162 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
163 "SystemManufacturer", REG_SZ, random.choice(self.SYSTEM_MANUFACTURERS))
164 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
165 "SystemProductName", REG_SZ, random.choice(self.SYSTEM_PRODUCTNAMES))
166
168 set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Services\\Disk\\Enum",
169 "0", REG_SZ, random.choice(self.HDD_PATHS))
170
180