Procedure examples

TrickBot has used a hidden VNC (hVNC) window to monitor the victim and collect information stealthily.

QuietSieve has the ability to execute payloads in a hidden window.

AvosLocker has hidden its console window by using the `ShowWindow` API function.

WindTail can instruct the OS to execute an application without a dock icon or menu.

Ursnif droppers have used COM properties to execute malware in hidden windows.

Tsundere Botnet’s MSI installer has used `-WindowStyle Hidden` to hide Tsundere Botnet’s execution from the user.

InvisibleFerret has executed Python instances of the browser module “.n2/bow” utilizing the `CREATE_NO_WINDOW` process creation flag.

SharpDisco can hide windows using `ProcessWindowStyle.Hidden`.

StrongPity has the ability to hide the console window for its document search module from the user.

Medusa Ransomware has utilized the `ShowWindow` function to hide current window.

BOOKWORM has created a hidden window when conducting key logging and clipboard theft through its KBLogger.dll module.

HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.

IMAPLoader hides the Windows Console window created by its execution by directly importing the `kernel32.dll` and `user32.dll` libraries `GetConsoleWindow` and `ShowWindow` APIs.

SystemBC has utilized the `-WindowStyle Hidden -ep bypass -file `to conceal PowerShell windows.

CANONSTAGER has created a new window with a height and width of zero to remain hidden on the screen.

Snip3 can execute PowerShell scripts in a hidden window.

InvisiMole has executed legitimate tools in hidden windows.

PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.

KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload.

PlugX has the ability to execute a command on a hidden desktop.

Lumma Stealer has utilized the .NET `ProcessStartInfo` class features to prevent the process from creating a visible window through setting the `CreateNoWindow` setting to “True,” which allows the executed command or script to run without displaying a command prompt window.

Cuba has executed hidden PowerShell windows.

PureCrypter can set `ProcessWindowStyle.Hidden` to hide windows on victim machines.

GlassWorm has leveraged Hidden Virtual Network Computing (HVNC) to remain undetected and conduct execution of collection and communication actions.

Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.

QUIETCANARY can execute processes in a hidden window.

LockBit 2.0 can execute command line arguments in a hidden window.

HotCroissant has the ability to hide the window for operations performed on a given file.

OilBooster can hide its console window upon execution through the `ShowWindow` API.

Kivars has the ability to conceal its activity through hiding active windows.

BONDUPDATER uses -windowstyle hidden to conceal a PowerShell window that downloads a payload.

Meteor can hide its console window upon execution to decrease its visibility to a victim.

KOCTOPUS has used -WindowsStyle Hidden to hide the command window.

Kevin can hide the current window from the targeted user via the `ShowWindow` API function.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.

Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window.

WarzoneRAT has the ability of performing remote desktop access via a hVNC window for decreased visibility.

SILENTTRINITY has the ability to set its window state to hidden.

AsyncRAT can hide the execution of scheduled tasks using `ProcessWindowStyle.Hidden`.

Remcos can set `ProcessWindowStyle.Hidden` to hide windows.

MCMD can modify processes to prevent them from being visible on the desktop.

Koadic has used the command Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden to hide its window.

QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.