| ID |
E1010 |
| Objective(s) |
Discovery |
| Related ATT&CK Techniques |
Application Window Discovery (T1010) |
| Version |
2.2 |
| Created |
4 December 2020 |
| Last Modified |
30 April 2024 |
Malware may attempt to gain information about the operating system and applications running on a system by enumerating open application windows.
| Name | ID | Description |
|---|
| Window Text | E1010.m01 | After finding an open application window, malware gets graphical window text. |
| Name | Date | Method | Description |
|---|
| Dark Comet | 2008 | E1010.m01 | DarkComet gets graphical window texts. [1] |
| Gamut | 2014 | E1010.m01 | Gamut gets graphical window texts. [1] |
| Hupigon | 2013 | E1010.m01 | Hupigon gets graphical window texts. [1] |
| Kovter | 2016 | E1010.m01 | Kovter gets graphical window texts. [1] |
| Rombertik | 2015 | E1010.m01 | Rombertik gets graphical window texts. [1] |
| UP007 | 2016 | E1010.m01 | UP007 gets graphical window text. [1] |
| Tool: capa | Mapping | APIs |
|---|
| get graphical window text | Application Window Discovery (E1010) | user32.IsWindowVisible, user32.SendMessage, user32.GetForegroundWindow, user32.GetWindowText |
| Tool: CAPE | Mapping | APIs |
|---|
| browser_needed | Application Window Discovery (E1010) | FindWindowW, FindWindowExA, FindWindowExW, FindWindowA |
Discovery::Application Window Discovery
SHA256: 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
Location: 0x455A5D
push 0x100 ; Maximum number of characters to get from window title, including trailing string terminator (in this case, 256).
lea param_1, [esp + 0x4]
push param_1 ; Buffer for receiving text from window
mov param_1, dword ptr [ebx + 0x30]
push param_1 ; Handle to window containing text
call USER32.DLL::GetWindowTextA ; Function call to fetch specified window title
[1] capa v4.0, analyzed at MITRE on 10/12/2022