Application Window Discovery

May 1, 2024 ยท View on GitHub

ID E1010
Objective(s) Discovery
Related ATT&CK Techniques Application Window Discovery (T1010)
Version 2.2
Created 4 December 2020
Last Modified 30 April 2024

Application Window Discovery

Malware may attempt to gain information about the operating system and applications running on a system by enumerating open application windows.

Methods

NameIDDescription
Window TextE1010.m01After finding an open application window, malware gets graphical window text.

Use in Malware

NameDateMethodDescription
Dark Comet2008E1010.m01DarkComet gets graphical window texts. [1]
Gamut2014E1010.m01Gamut gets graphical window texts. [1]
Hupigon2013E1010.m01Hupigon gets graphical window texts. [1]
Kovter2016E1010.m01Kovter gets graphical window texts. [1]
Rombertik2015E1010.m01Rombertik gets graphical window texts. [1]
UP0072016E1010.m01UP007 gets graphical window text. [1]

Detection

Tool: capaMappingAPIs
get graphical window textApplication Window Discovery (E1010)user32.IsWindowVisible, user32.SendMessage, user32.GetForegroundWindow, user32.GetWindowText
Tool: CAPEMappingAPIs
browser_neededApplication Window Discovery (E1010)FindWindowW, FindWindowExA, FindWindowExW, FindWindowA

E1010 Snippet

Discovery::Application Window Discovery SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db Location: 0x455A5D
push    0x100   ; Maximum number of characters to get from window title, including trailing string terminator (in this case, 256).
lea     param_1, [esp + 0x4]
push    param_1 ; Buffer for receiving text from window
mov     param_1, dword ptr [ebx + 0x30]
push    param_1 ; Handle to window containing text
call    USER32.DLL::GetWindowTextA      ; Function call to fetch specified window title

References

[1] capa v4.0, analyzed at MITRE on 10/12/2022