{
  "family": "screenmate",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "Joke:Win32/Screenmate (also classified as Riskware or PUA) refers to a broad category of vintage novelty programs designed to display animated characters, animals, or objects interacting with the Windows desktop environment. While generally harmless and intended for entertainment (e.g., the infamous 'Desktop Goose' or vintage 'Neko' cat), in an enterprise environment, they are classified as Riskware because they consume unnecessary resources, distract users, and are frequently bundled with actual spyware or adware.<br><br><b>Understanding the Screenmate Threat</b><br>To an end-user, a Screenmate is a fun, novelty application they downloaded from a forum. For a corporate IT department, it is a nuisance application that violates Acceptable Use Policies and represents a failure in endpoint application whitelisting. Technically, Screenmates often require high privileges to draw over other windows and hook into mouse/keyboard inputs, mirroring the behaviors of actual malware.<br><br><b>Execution and Risk Profile</b><br>Screenmates are typically downloaded manually by users seeking desktop customizations (`T1204.002`). Upon execution, they use Windows GDI (Graphics Device Interface) APIs to draw animated sprites directly onto the desktop, often setting their window to 'always on top'. To create interactive effects, they utilize system-wide API hooks (`T1056`) to monitor mouse coordinates and keyboard input. While the program itself may just be a joke (`T1491`), the *method* of delivery is identical to adware, and modern threat actors frequently take popular, open-source Screenmate code and repackage it with hidden cryptominers or infostealers (`T1189`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a loss of productivity, minor system sluggishness, and the potential for secondary malware infection. IoCs are highly visible: unauthorized animated characters moving across the user's screen. EDR logs will flag unsigned executables (often running from the `%Downloads%` folder) making extensive use of `SetWindowsHookEx` to intercept mouse/keyboard input.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Screenmate and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Screenmate is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Screenmate establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Screenmate typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Screenmate compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Screenmate should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Screenmate leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Screenmate frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Screenmate maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Screenmate often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1189",
    "T1491",
    "T1056"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (User-initiated download)",
      "tactic": "Execution"
    },
    {
      "id": "T1056",
      "name": "Input Capture (API hooking for interactivity)",
      "tactic": "Collection"
    },
    {
      "id": "T1491",
      "name": "Defacement (Altering the desktop environment)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled secondary payloads)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Terminate the active Screenmate process via the Windows Task Manager.",
    "Locate and delete the executable from the user's local profile (usually `%Downloads%` or the Desktop).",
    "Perform a comprehensive endpoint scan using an enterprise AV/EDR solution to ensure the Screenmate wasn't a trojan horse bundled with actual malware.",
    "Use this incident as an opportunity to reinforce corporate policies regarding the installation of unapproved, unsigned third-party software."
  ],
  "what_to_avoid": [
    "Do not ignore the incident simply because it's a 'joke' program; its presence indicates the user has the ability to download and execute arbitrary, unsigned code.",
    "Avoid assuming the program is benign; always check for hidden secondary payloads dropped during installation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}