NtTraceExtractor.py

#!/usr/bin/env python


__author__ = 'AR'
import json, sys, subprocess, string, os, time

sampleNum = 0

if len(os.sys.argv) < 5:
    print "Usage: ./ntTraceextractor -f [imput command file] -o [destination for nttrace files]"
    os.sys.exit()

for i in xrange(len(sys.argv)):
	if sys.argv[i] == '-f':
		inputCmdFile = sys.argv[i + 1]
	if sys.argv[i] == '-o':
		destPath = sys.argv[i + 1]


########## Execute the command as child process ##########
def executeChildProcess(command):
	global sampleNum
	modifiedCommand = 'nttrace ' + str(command)
	with open(destPath + str(sampleNum).zfill(4) + '.trace', 'a') as f:
		sampleNum += 1
		ps = subprocess.Popen(modifiedCommand, stderr=subprocess.PIPE, stdout=f, shell=True)

		time.sleep(2)
	ps.terminate()

def main():
	with open(inputCmdFile, 'r') as cmdFile:
		cmdList = cmdFile.readlines()

	# Specify the path to the benign executables for filesList variable
	filesList = os.listdir("C:\Windows\System32\\")
	for exeFile in filesList:
		if exeFile.endswith(".exe") and not exeFile == "logoff.exe" and not exeFile == "shutdown":
			executeChildProcess(exeFile)

	for cmd in cmdList:
		executeChildProcess(cmd)

if __name__=="__main__":
    print '{:*^70}'.format(" Machine Learning and Malware Classification ")
    main()
    print '{:*^70}'.format('All Strace stored to ' + destPath + ' directory')
    print
    print '{:*^70}'.format(" EOP ")