Roblox.py

# Author:     Bickford, Ian
# Course:     Digital Forensics
# Assignment: Final Project
# File Name:  Roblox.py

# Goal: The goal of this python file is to create a benign malware. That is, I want to simulate actions that are indicative of a malicous program, 
#       but with no actual payload or transmission method. This malware will take actions that are not malicious on their own, but are typically
#       associated with malicious programs. This is designed to be used with sysInternals to detect each indicator and was designed with Process Manager,
#       Process Explorer, Sysmon, and PSExec in mind as to how I was going to detect each indicator.

# DISCLAIMER: Due to the nature of what this program does, it is highly recommended to run this software in a VM enviroment. Although there is no payload or
#             or transmission method, if this file was not delivered via the author of this file it may have been altered in a way where it is no longer benign.
#             I do not authorize or condone anyone adapting this file to write non-benign malware and take no responsibility in the distribution or alteration of 
#             this file. This file was written with precautions taken and ethical guidelines followed. Use at your own discretion.

'''
# What this file will do:
    # -Create a temporary file in the %AppData% directory, it will also write to it.
    # -Write a registry key to enable autorun/persitence to simulate APT.
    # -Dynamically load a DLL.
    # -Open TCP connections with an external host.
    # -Change timestamps of temporary file we added.
    # -Create no window subprocess (child processes) to simulate additional executables being ran.
    # -Create a pop-up to fake the user into thinking the program ran into an error.
'''

import os
import ctypes
from datetime import datetime as dt
import winreg
import subprocess as sp
import socket

# This line of code is used in conjuction with trying to launch the .exe file associated with this .py file. The purpose of it is to fake the user into thinking
# that they cannot run Roblox, and that is why it doesn't launch when they click the executable. Instead, its just an error pop-up window concealing the fact
# that we are executing malicious code and Roblox was never going to run in the first place. The line of code is using a library that we will use in a later
# indicator, it uses a dll library, accesses the user32 dll, and makes a Message box appear. The arguments are 0 as the handle owner for the window that will appear
# my message inside the window GUI, the title of the window, 0x10 is the hexidecimal value for the error icon, and the 0x0 is the value for a single mouse button
# labled ok. When you click the button, the window will close.   

ctypes.windll.user32.MessageBoxW(0, "Your system does not meet minimum requirements to run Roblox! ", "Error", 0x10 | 0x0)

'''
Malicious Indicator 1:
We are creating a dynamic file path to the APPDATA directory and saving it to the variable tmp_path. We do so by importing a library called os and using the 
sub-library path. We then use a method called expandvars to search for where the APPDATA directory is. The next part uses the file path and allows us to write 
to the file we have created. A malicious program may do this when it has stolen data from your computer, and wants to write it into an inconspicious file name, 
then send that file to themselves through the TCP connection we will establish further down in this file. 

We have also made the file hidden so users can't find it if they do not have the hidden files shown set to yes in the advanced settings of their file explorer.
To hide the file we use the ctypes library, we then use the sub library of windll which contains Windows DLL functions. We then use kernel32 which is a core
Windows system DLL. Finally we use the SetFilesAttributes method, feed the file path to the method, and the hexdecimal value `0x2`, which is the value used to make 
a file hidden in windows.
'''
# Creating file, setting the file path, and writing to the file.   
tmpPath = os.path.expandvars(r"%APPDATA%\RobloxLogs.tmp")
ctypes.windll.kernel32.SetFileAttributesW(tmpPath, 0x80) # Must set the file as no longer hidden in the event the file was already created in order to write to it.
with open(tmpPath, "w") as f:
    f.write("This is super confidential stuff that I stole from your computer and writing to a file to send to myself. Mwahahahahah.")

# Setting the file to hidden.
ctypes.windll.kernel32.SetFileAttributesW(tmpPath, 0x2)
print("Created a hidden file, and then wrote to it.")

'''
Malicious Indicator 2:
In this indicator, we are going to modify the timestamps for the temporary file that we created and wrote to in the previous indicator. We would want to do this
to make users who may find our hidden file believe that this file is truly a temporary file that has been JUST created and updated.     
'''
mod_time = dt.now().timestamp()
try:
    os.utime(tmpPath, (mod_time, mod_time))
    err = 0 # If err == 0, then we did modify the file. This is for debugging.
    print("Altered timestamps (time stomping) of the hidden file we created.")
except Exception:
    err = 1 # If err == 1, then we did not modify the file. This is for debugging.
    pass # Pass just means we want any errors to be handled silently and gracefully.

'''
Malicious Indicator 3:
In this indicator, we are creating a registry key. For the purpose of this project and not providing the method in which you would need
to run this file specifically from the windows registry, we are simply going to open a cmd prompt and echo something silly. However, if done right, this is how
you would be able to force the program to run every single time the person who downloaded this file logs in to their computer. If we were nefarious, this section
becomes essential, because I can now auto-run my program frequently without the need for you to run this file. It is not fully userless activation, since we still
need to trick the user into opening the file at least once. But after this, we now have the ability to activate without user interaction (aside from logging in).

To explain the code written below, we are creating a variable name `regPath` that saves the registry path to where we want to place our `auto-run` key and value.
The next line we open a key in the Windows Registry under the current user hive, using the regPath we set before to access the sub-key path, using a number 0 because
this is a reserved parameter according to Windows API specifications, and the set value argument to allow for write control of the key.
The next line we are then using a method that allows us to create a value for the key, we name it RobloxOnStartUp, 0 is reserved once again, REG_SZ specifies the data
type as a string, and the final argument is the string for what we want to do with our registry key and value. For this we just made a silly string to be echoed
in cmd prompt and then close.  
'''

try:
    regPath = r"Software\Microsoft\Windows\CurrentVersion\Run"
    with winreg.OpenKey(winreg.HKEY_CURRENT_USER, regPath, 0, winreg.KEY_SET_VALUE) as key:
        winreg.SetValueEx(key, "RobloxOnStartUp", 0, winreg.REG_SZ, "cmd.exe /c echo Roblox on start up doesn't make sense. LOL.")
    print("Created a new registry key and set the value, it is currenly in an autorun functionality on log-in.")
except Exception as e:
    print("Registry demonstration failed.", e)

'''
Malicious Indicator 4:
In this indicator, we are going to simply just open another executable file. We are doing this to simulate our `malware` launching other shells/scripts. In this
case, we are simply opening a command prompt. However, we are going to open it as a subprocess so that it is running in the background and does not appear as a window
or on the taskbar. When we do this, if were executing additonal scripts or shells, we could open this in the same way and the user would never know that they were
running in the background. Unfortunately, we cannot hide it from taskmanager without kernel manipulation. I am not competent enough to do kernel manipulation.

To achieve this, we first make a list of all the subprocesses we are about to create so we can close them later for testing purposes. We then append each subprocess
to the list. Inside the append method we are creating a subprocess using the `Popen` method and defining our arguments. The first argument is indicating which 
executable we would like to open, the windowstyle and hidden arguments opens powershell hidden from the user (i.e. it does not appear as a window or on the taskbar
but still exists in taskmanager). Then using our hidden powershell, we will open the executeable that we would want via a terminal command. In this case we are just
going to open command prompt, but you could replace this with another malicious program and that will be hidden in the same way that powershell is.
'''       
processes = []
processes.append(sp.Popen(["powershell.exe", "-WindowStyle", "Hidden", "-Command", "Start-Process cmd.exe -WindowStyle Hidden;"]))

# Uncomment this section to end the subprocesses you create.
# for proc in processes:
#     proc.terminate()
#     proc.wait()
print("Child process created in the background.")

'''
Malicious Indicator 5:
In this indicator, we are opening a DLL for our system to utlize. DLLs are a major vulnerability in Windows and you can load malicous code through DLLs.

We have already basically went over what this command does, but the method we are using this time is the LoadLibrary method.    
'''
try:
    ctypes.windll.LoadLibrary("kernel32.dll") # This DLL is harmless, we actually used it in the writing to a hidden file indicator above.
    print("Loaded a `malicious` DLL: kernel32.dll")
except Exception:
    pass   # Pass just means we want any errors to be handled silently and gracefully. 

'''
Malicous Indicator 6:
In this indicator we are going to establish a TCP connection with an external host. In this case, it is harmless because we are just making a connection
to Google, but I could make it so that the TCP connection was to an IP Address that is under my control. Using this connection, I can become a persitent threat
that is capable of remotely executing code. Additionally, you could use this connection to exfiltrate data from the system that is effected with this malware. I
will not be showing how to do any of that, instead I am just making a TCP connection through this file to show that it is possible. 

socket.socket() creates a new socket object. The arguments in order are the address family (in this case it is IPv4, you can switch it to IPv6 by adding a 6 at
the end of AF_INET), and socket.SOCK_STREAM just means that we are using the Transmission Control Protocol (TCP). s.connect actually opens the TCP connection to
"google.com" and the 443 is the port number on the remote host that we are connecting to. Port 443 is the standard port for HTTPS traffic.
'''

try:
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect(("google.com", 443))  # Opens a TCP connection to Google's public web server, then closes it
        err1 = s.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR) # For debugging, if err1 == 0, it established the connection.
    print("Opened a TCP connection to external host.")
except Exception:
    pass # Pass just means we want any errors to be handled silently and gracefully.