GetForegroundWindow

Created the Thursday 01 October 2020. Updated 2 years, 12 months ago.

This technique uses the GetForegroundWindow and Sleep APIs to attempt to evade sandboxes. Many sandboxes do not alter the foreground window like a user would in a normal desktop environment.

It accomplishes this by making a call to GetForegroundWindow, which returns a handle to the current window. Then the malware sample will sleep for a short time, followed by another call to GetForegroundWindow. If the foreground window has not changed, the malware assumes it is in a sandbox or analysis virtual machine and will continue this loop until the foreground window changes. If there is no change, the program will loop indefinitely or may make a call to ExitProcess.

Technique Identifier

U1301

Technique Tag

GetForegroundWindow

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

Code Snippets

Description

This technique is using the API GetForegroundWindow.

#include <winuser.h> // Required import for GetForegroundWindow API
 
int main()
{
 
    //Get a handle to user's current foreground window.
    int foregroundWindowHandle1 = GetForegroundWindow(); 
 
    do {
 
        //Sleep for .1 second.
        Sleep(100); 
 
        //Get a handle to user's current foreground window again.
        int foregroundWindowHandle2 = GetForegroundWindow(); 
 
        }
 
    //While the handles to the current foreground windows are equal, continue to loop.
    while (foregroundWindowHandle1 == foregroundWindowHandle2);
 
    return 0;
};

package main

import (
	"fmt"
	"golang.org/x/sys/windows"
	"syscall"
	"unsafe"
)

var (
	user32 = windows.NewLazySystemDLL("user32.dll")
	// https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextw
	procGetWindowText = user32.NewProc("GetWindowTextW")
	// https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextlengthw
	procGetWindowTextL = user32.NewProc("GetWindowTextLengthW")
)

func getWindowTextLength(windowHandle windows.HWND) int {
	ret, _, _ := procGetWindowTextL.Call(uintptr(windowHandle))

	return int(ret)
}

func getWindowName(fg windows.HWND) string {
	// +1 to get the last character of the string
	var titleBarFullLen = int(getWindowTextLength(fg)) + 1

	buf := make([]uint16, titleBarFullLen)
	procGetWindowText.Call(
		uintptr(fg),
		uintptr(unsafe.Pointer(&buf[0])),
		uintptr(titleBarFullLen))

	return syscall.UTF16ToString(buf)
}

func main() {
	var foregroundWindowHandle windows.HWND = windows.GetForegroundWindow()
	var windowName string = getWindowName(foregroundWindowHandle)

	fmt.Println("Foreground window handle: ", foregroundWindowHandle)
	fmt.Println("Window name: ", windowName)
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

News from the Lab Archive : January 2004 to September 2015