GetForegroundWindow

Created the Thursday 01 October 2020. Updated 1 year, 8 months ago.

This technique uses the GetForegroundWindow and Sleep APIs to attempt to evade sandboxes. Many sandboxes do not alter the foreground window like a user would in a normal desktop environment.

It accomplishes this by making a call to GetForegroundWindow, which returns a handle to the current window. Then the malware sample will sleep for a short time, followed by another call to GetForegroundWindow. If the foreground window has not changed, the malware assumes it is in a sandbox or analysis virtual machine and will continue this loop until the foreground window changes. If there is no change, the program will loop indefinitely or may make a call to ExitProcess.

Technique Identifier

U1301

Technique Tag

GetForegroundWindow

Code Snippets

Description

This technique is using the API GetForegroundWindow.

#include <winuser.h> // Required import for GetForegroundWindow API
 
int main()
{
 
    //Get a handle to user's current foreground window.
    int foregroundWindowHandle1 = GetForegroundWindow(); 
 
    do {
 
        //Sleep for .1 second.
        Sleep(100); 
 
        //Get a handle to user's current foreground window again.
        int foregroundWindowHandle2 = GetForegroundWindow(); 
 
        }
 
    //While the handles to the current foreground windows are equal, continue to loop.
    while (foregroundWindowHandle1 == foregroundWindowHandle2);
 
    return 0;
};

About Author Open Snippet

Author: Kyle Cucci (d4rksystem) / Target Platform: Windows

package main

import (
	"fmt"
	"golang.org/x/sys/windows"
	"syscall"
	"unsafe"
)

var (
	user32 = windows.NewLazySystemDLL("user32.dll")
	// https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextw
	procGetWindowText = user32.NewProc("GetWindowTextW")
	// https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getwindowtextlengthw
	procGetWindowTextL = user32.NewProc("GetWindowTextLengthW")
)

func getWindowTextLength(windowHandle windows.HWND) int {
	ret, _, _ := procGetWindowTextL.Call(uintptr(windowHandle))

	return int(ret)
}

func getWindowName(fg windows.HWND) string {
	// +1 to get the last character of the string
	var titleBarFullLen = int(getWindowTextLength(fg)) + 1

	buf := make([]uint16, titleBarFullLen)
	procGetWindowText.Call(
		uintptr(fg),
		uintptr(unsafe.Pointer(&buf[0])),
		uintptr(titleBarFullLen))

	return syscall.UTF16ToString(buf)
}

func main() {
	var foregroundWindowHandle windows.HWND = windows.GetForegroundWindow()
	var windowName string = getWindowName(foregroundWindowHandle)

	fmt.Println("Foreground window handle: ", foregroundWindowHandle)
	fmt.Println("Window name: ", windowName)
}

About Author Open Snippet

Author: Edode / Target Platform: Windows

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

News from the Lab Archive : January 2004 to September 2015