Update Date
01/15/2024

Class: Trojan

A malicious program designed to electronically spy on the user’s activities (intercept keyboard input, take screenshots, capture a list of active applications, etc.). The collected information is sent to the cybercriminal by various means, including email, FTP, and HTTP (by sending data in a request).

Read more

Platform: Win32

Win32 is an API on Windows NT-based operating systems (Windows XP, Windows 7, etc.) that supports execution of 32-bit applications. One of the most widespread programming platforms in the world.

Family: Refroso

No family description

Examples

60A06ABAEB3E1B134D9B28F75B41A6F1
3824AB459F4EB35D07E72B6B31CBDFCF
B08C6BDD89803CF2C8ECC15E2DFF3AB1
DACE550E8FB59C67FEFEC7A984D3843C
8A2890F2D94E71C5E8ADCB8BE9362820

Tactics and Techniques: Mitre*

TA0003
Persistence

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:WindowsSystem32, and C:WindowssysWOW64 on 64-bit Windows systems, along with screensavers included with base Windows installations.


The following screensaver settings are stored in the Registry (HKCUControl PanelDesktop) and could be manipulated to achieve persistence:


* SCRNSAVE.exe – set to malicious PE path

* ScreenSaveActive – set to ‘1’ to enable the screensaver

* ScreenSaverIsSecure – set to ‘0’ to not require a password to unlock

* ScreenSaveTimeout – sets user inactivity timeout before screensaver is executed


Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)


T1546.002
Event Triggered Execution: Screensaver

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:WindowsSystem32, and C:WindowssysWOW64 on 64-bit Windows systems, along with screensavers included with base Windows installations.


The following screensaver settings are stored in the Registry (HKCUControl PanelDesktop) and could be manipulated to achieve persistence:


* SCRNSAVE.exe – set to malicious PE path

* ScreenSaveActive – set to ‘1’ to enable the screensaver

* ScreenSaverIsSecure – set to ‘0’ to not require a password to unlock

* ScreenSaveTimeout – sets user inactivity timeout before screensaver is executed


Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)


TA0004
Privilege Escalation

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:WindowsSystem32, and C:WindowssysWOW64 on 64-bit Windows systems, along with screensavers included with base Windows installations.


The following screensaver settings are stored in the Registry (HKCUControl PanelDesktop) and could be manipulated to achieve persistence:


* SCRNSAVE.exe – set to malicious PE path

* ScreenSaveActive – set to ‘1’ to enable the screensaver

* ScreenSaverIsSecure – set to ‘0’ to not require a password to unlock

* ScreenSaveTimeout – sets user inactivity timeout before screensaver is executed


Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)


T1546.002
Event Triggered Execution: Screensaver

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:WindowsSystem32, and C:WindowssysWOW64 on 64-bit Windows systems, along with screensavers included with base Windows installations.


The following screensaver settings are stored in the Registry (HKCUControl PanelDesktop) and could be manipulated to achieve persistence:


* SCRNSAVE.exe – set to malicious PE path

* ScreenSaveActive – set to ‘1’ to enable the screensaver

* ScreenSaverIsSecure – set to ‘0’ to not require a password to unlock

* ScreenSaveTimeout – sets user inactivity timeout before screensaver is executed


Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)


* © 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Kaspersky Next
Let’s go Next: redefine your business’s cybersecurity
Learn more
New Kaspersky!
Your digital life deserves complete protection!
Learn more
Confirm changes?
Your message has been sent successfully.