Procedure examples

MacSpy stores itself in ~/Library/.DS_Stores/

LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".

SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.

attrib can be used to make files or directories hidden.

Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.

QuasarRAT has the ability to set file attributes to "hidden" to hide files from the compromised user's view in Windows File Explorer.

TeamPCP Cloud Stealer can create a hidden directory in the user's home folder on Linux hosts to write a python backdoor.

TeamPCP has used a hidden .lock file to establish a 12 hour cooldown period between re-drops for installed malware.

Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.

Dragonfly has modified the Registry to hide created user accounts.

SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.

APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.

Kimsuky has used an information gathering module that will hide an AV software window from the victim. Kimsuky has also been known to use `-WindowStyle Hidden` to conceal PowerShell windows.

Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

APT32 has used the WindowStyle parameter to conceal PowerShell windows.

Gamaredon Group has used hidcon to run batch files in a hidden console window. Gamaredon Group has also executed PowerShell in a hidden window.

FIN7 has used .txt files to conceal PowerShell commands.

Higaisa used a payload that creates a hidden window.

DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.

Medusa Group has utilized the `ShowWindow` API function to hide the current window.

Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

ToddyCat has hidden malicious scripts using `powershell.exe -windowstyle hidden`.

APT28 has used the WindowStyle parameter to conceal PowerShell windows.

APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.

CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.

VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include `-nop -w hidden- ep bypass -enc`.

Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.

APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Nomadic Octopus executed PowerShell in a hidden window.

TrickBot has used a hidden VNC (hVNC) window to monitor the victim and collect information stealthily.

QuietSieve has the ability to execute payloads in a hidden window.

AvosLocker has hidden its console window by using the `ShowWindow` API function.

WindTail can instruct the OS to execute an application without a dock icon or menu.

Ursnif droppers have used COM properties to execute malware in hidden windows.

Tsundere Botnet’s MSI installer has used `-WindowStyle Hidden` to hide Tsundere Botnet’s execution from the user.

InvisibleFerret has executed Python instances of the browser module “.n2/bow” utilizing the `CREATE_NO_WINDOW` process creation flag.

SharpDisco can hide windows using `ProcessWindowStyle.Hidden`.

StrongPity has the ability to hide the console window for its document search module from the user.

Medusa Ransomware has utilized the `ShowWindow` function to hide current window.

BOOKWORM has created a hidden window when conducting key logging and clipboard theft through its KBLogger.dll module.

HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.

IMAPLoader hides the Windows Console window created by its execution by directly importing the `kernel32.dll` and `user32.dll` libraries `GetConsoleWindow` and `ShowWindow` APIs.

SystemBC has utilized the `-WindowStyle Hidden -ep bypass -file `to conceal PowerShell windows.

CANONSTAGER has created a new window with a height and width of zero to remain hidden on the screen.

Snip3 can execute PowerShell scripts in a hidden window.

InvisiMole has executed legitimate tools in hidden windows.

PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.

KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload.

PlugX has the ability to execute a command on a hidden desktop.

Lumma Stealer has utilized the .NET `ProcessStartInfo` class features to prevent the process from creating a visible window through setting the `CreateNoWindow` setting to “True,” which allows the executed command or script to run without displaying a command prompt window.