modules.auxiliary.disguise

Package modules :: Package auxiliary :: Module disguise |
[hide private]
[frames] | no frames]

# Source Code for Module modules.auxiliary.disguise

      1  # Copyright (C) 2010-2013 Claudio Guarnieri.
      2  # Copyright (C) 2014-2016 Cuckoo Foundation.
      3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
      4  # See the file 'docs/LICENSE' for copying permission.
      5
      6  import itertools
      7  import logging
      8  import random
      9
     10  from _winreg import HKEY_LOCAL_MACHINE, REG_SZ, REG_MULTI_SZ, REG_BINARY
     11
     12  from lib.common.abstracts import Auxiliary
     13  from lib.common.rand import random_integer, random_string
     14  from lib.common.registry import rename_regkey, regkey_exists
     15  from lib.common.registry import set_regkey, query_value
     16
     17  log = logging.getLogger(__name__)
     18
     19 -class Disguise(Auxiliary):
     20      """Disguise the analysis environment."""
     21
     22      HDD_IDENTIFIERS = [
     23          "ST9160411AS",
     24      ]
     25
     26      HDD_PATHS = [
     27          "IDE\\DiskST9160411AS_____________________________LV14____",
     28          "IDE\\DiskKINGSTON_SV300S_________________________541A____",
     29      ]
     30
     31      CDROM_IDENTIFIERS = [
     32          "HL-DT-ST RW/DVD MU10N",
     33      ]
     34
     35      SYSTEM_BIOS_DATES = [
     36          "03/11/11",
     37          "01/09/09",
     38      ]
     39
     40      SYSTEM_BIOS_VERSIONS = [
     41          ["LENOVO - 3220", "Ver 1.00PARTTBL("],
     42          ["LENOVO - 2020", "Ver 1.00PARTTBLX"],
     43      ]
     44
     45      VIDEO_BIOS_DATES = [
     46          "02/10/20",
     47          "06/12/20",
     48      ]
     49
     50      VIDEO_BIOS_VERSIONS = [
     51          ["Hardware Version 0.0", "PARTTBLX"],
     52      ]
     53
     54      BIOS_VERSIONS = [
     55          "6FET56WW (2.02 )",
     56          "7UET92WW (3.22 )",
     57      ]
     58
     59      SYSTEM_MANUFACTURERS = [
     60          "LENOVO",
     61      ]
     62
     63      SYSTEM_PRODUCTNAMES = [
     64          "64755N2",
     65          "2241W2U",
     66      ]
     67
     68 -    def change_productid(self):
     69          """Randomizes Windows ProductId.
     70          The Windows ProductId is occasionally used by malware
     71          to detect public setups of Cuckoo, e.g., Malwr.com.
     72          """
     73          value = "{0}-{1}-{2}-{3}".format(random_integer(5), random_integer(3),
     74                                           random_integer(7), random_integer(5))
     75
     76          set_regkey(HKEY_LOCAL_MACHINE,
     77                     "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
     78                     "ProductId", REG_SZ, value)
     79
     80 -    def patch_scsi_identifiers(self):
     81          types = {
     82              "DiskPeripheral": self.HDD_IDENTIFIERS,
     83              "CdRomPeripheral": self.CDROM_IDENTIFIERS,
     84          }
     85
     86          for row in itertools.product([0, 1, 2, 3], [0, 1, 2, 3], [0, 1, 2, 3], [0, 1, 2, 3]):
     87              type_ = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row, "Type")
     88              value = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row, "Identifier")
     89              if not type_ or not value:
     90                  continue
     91
     92              value = value.lower()
     93              if "vbox" in value or "vmware" in value or "qemu" in value or "virtual" in value:
     94                  if type_ in types:
     95                      new_value = random.choice(types[type_])
     96                  else:
     97                      log.warning("Unknown SCSI type (%s), disguising it with a random string", type_)
     98                      new_value = random_string(len(value))
     99
    100                  set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port %d\\Scsi Bus %d\\Target Id %d\\Logical Unit Id %d" % row,
    101                             "Identifier", REG_SZ, new_value)
    102
    103 -    def patch_bios(self):
    104          set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "SystemBiosDate", REG_SZ, random.choice(self.SYSTEM_BIOS_DATES))
    105          set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "SystemBiosVersion", REG_MULTI_SZ, random.choice(self.SYSTEM_BIOS_VERSIONS))
    106          set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "VideoBiosDate", REG_SZ, random.choice(self.VIDEO_BIOS_DATES))
    107          set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System", "VideoBiosVersion", REG_MULTI_SZ, random.choice(self.VIDEO_BIOS_VERSIONS))
    108
    109 -    def patch_acpi(self):
    110          # TODO This should be improved, but for now may suffice.
    111          keywords = {
    112              "VBOX": "LNVO",
    113              "vbox": "lnvo",
    114              "VirtualBox": "LENOVOTP",
    115              "innotek GmbH": "",
    116          }
    117
    118          regkeys = [
    119              ["SYSTEM\\CurrentControlSet\\Services\\mssmbios\\Data", "AcpiData"],
    120              ["SYSTEM\\ControlSet001\\Services\\mssmbios\\Data", "AcpiData"],
    121
    122              ["SYSTEM\\CurrentControlSet\\Services\\mssmbios\\Data", "SMBiosData"],
    123              ["SYSTEM\\ControlSet001\\Services\\mssmbios\\Data", "SMBiosData"],
    124          ]
    125
    126          for regkey, key in regkeys:
    127              value = query_value(HKEY_LOCAL_MACHINE, regkey, key)
    128              if value is None:
    129                  continue
    130
    131              for k, v in keywords.items():
    132                  value = value.replace(k, v)
    133
    134              set_regkey(HKEY_LOCAL_MACHINE, regkey, key, REG_BINARY, value)
    135
    136          if regkey_exists(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__"):
    137              rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\DSDT\\VBOX__", "LENOVO")
    138              rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\FADT\\VBOX__", "LENOVO")
    139              rename_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\ACPI\\RSDT\\VBOX__", "LENOVO")
    140
    141 -    def patch_processor(self):
    142          keywords = {
    143              "QEMU Virtual CPU version 2.0.0": "Intel(R) Core(TM) i7 CPU @3GHz",
    144          }
    145
    146          for idx in xrange(32):
    147              value = query_value(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" % idx, "ProcessorNameString")
    148              if value is None:
    149                  continue
    150
    151              for k, v in keywords.items():
    152                  value = value.replace(k, v)
    153
    154              set_regkey(HKEY_LOCAL_MACHINE, "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" % idx,
    155                         "ProcessorNameString", REG_SZ, value)
    156
    157 -    def patch_manufacturer(self):
    158          set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
    159                     "BIOSVersion", REG_SZ, random.choice(self.BIOS_VERSIONS))
    160          set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
    161                     "BIOSReleaseDate", REG_SZ, random.choice(self.SYSTEM_BIOS_DATES))
    162          set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
    163                     "SystemManufacturer", REG_SZ, random.choice(self.SYSTEM_MANUFACTURERS))
    164          set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Control\\SystemInformation",
    165                     "SystemProductName", REG_SZ, random.choice(self.SYSTEM_PRODUCTNAMES))
    166
    167 -    def patch_hdd_path(self):
    168          set_regkey(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet001\\Services\\Disk\\Enum",
    169                     "0", REG_SZ, random.choice(self.HDD_PATHS))
    170
    171 -    def start(self):
    172          self.change_productid()
    173          self.patch_scsi_identifiers()
    174          self.patch_bios()
    175          self.patch_acpi()
    176          self.patch_processor()
    177          self.patch_manufacturer()
    178          self.patch_hdd_path()
    179          return True
    180