def set_clock(clock): st = SYSTEMTIME() st.wYear = clock.year st.wMonth = clock.month st.wDay = clock.day st.wHour = clock.hour st.wMinute = clock.minute st.wSecond = clock.second st.wMilliseconds = 0 KERNEL32.SetSystemTime(ctypes.byref(st))
def prepare(self): """Prepare env for analysis.""" global DEFAULT_DLL global SERVICES_PID global HIDE_PIDS # Get SeDebugPrivilege for the Python process. It will be needed in # order to perform the injections. grant_debug_privilege() # randomize cuckoomon DLL and loader executable names copy("dll\\cuckoomon.dll", CUCKOOMON32_NAME) copy("dll\\cuckoomon_x64.dll", CUCKOOMON64_NAME) copy("bin\\loader.exe", LOADER32_NAME) copy("bin\\loader_x64.exe", LOADER64_NAME) # Create the folders used for storing the results. create_folders() add_protected_path(os.getcwd()) add_protected_path(PATHS["root"]) # Initialize logging. init_logging() # Parse the analysis configuration file generated by the agent. self.config = Config(cfg="analysis.conf") # Set virtual machine clock. clock = datetime.strptime(self.config.clock, "%Y%m%dT%H:%M:%S") systime = SYSTEMTIME() systime.wYear = clock.year systime.wMonth = clock.month systime.wDay = clock.day systime.wHour = clock.hour systime.wMinute = clock.minute systime.wSecond = clock.second systime.wMilliseconds = 0 KERNEL32.SetSystemTime(byref(systime)) thedate = clock.strftime("%m-%d-%y") thetime = clock.strftime("%H:%M:%S") log.info("Date set to: {0}, time set to: {1}".format(thedate, thetime)) # Set the default DLL to be used by the PipeHandler. DEFAULT_DLL = self.config.get_options().get("dll") # get PID for services.exe for monitoring services svcpid = self.pids_from_process_name_list(["services.exe"]) if svcpid: SERVICES_PID = svcpid[0] protected_procname_list = [ "vmwareuser.exe", "vmwareservice.exe", "vboxservice.exe", "vboxtray.exe", "sandboxiedcomlaunch.exe", "sandboxierpcss.exe", "procmon.exe", "regmon.exe", "filemon.exe", "wireshark.exe", "netmon.exe", "prl_tools_service.exe", "prl_tools.exe", "prl_cc.exe", "sharedintapp.exe", "vmtoolsd.exe", "vmsrvc.exe", "python.exe", "perl.exe", ] HIDE_PIDS = set(self.pids_from_process_name_list(protected_procname_list)) # Initialize and start the Pipe Servers. This is going to be used for # communicating with the injected and monitored processes. for x in xrange(self.PIPE_SERVER_COUNT): self.pipes[x] = PipeServer(self.config) self.pipes[x].daemon = True self.pipes[x].start() # We update the target according to its category. If it's a file, then # we store the path. if self.config.category == "file": self.target = os.path.join(os.environ["TEMP"] + os.sep, str(self.config.file_name)) # If it's a URL, well.. we store the URL. else: self.target = self.config.target