{
  "family": "screenmate",
  "sample_count": 6,
  "category": "advanced_threat",
  "description": "Joke:Win32/Screenmate (also classified as Riskware or PUA) refers to a broad category of vintage novelty programs designed to display animated characters, animals, or objects interacting with the Windows desktop environment. While generally harmless and intended for entertainment (e.g., the infamous 'Desktop Goose' or vintage 'Neko' cat), in an enterprise environment, they are classified as Riskware because they consume unnecessary resources, distract users, and are frequently bundled with actual spyware or adware.<br><br><b>Understanding the Screenmate Threat</b><br>To an end-user, a Screenmate is a fun, novelty application they downloaded from a forum. For a corporate IT department, it is a nuisance application that violates Acceptable Use Policies and represents a failure in endpoint application whitelisting. Technically, Screenmates often require high privileges to draw over other windows and hook into mouse/keyboard inputs, mirroring the behaviors of actual malware.<br><br><b>Execution and Risk Profile</b><br>Screenmates are typically downloaded manually by users seeking desktop customizations (`T1204.002`). Upon execution, they use Windows GDI (Graphics Device Interface) APIs to draw animated sprites directly onto the desktop, often setting their window to 'always on top'. To create interactive effects, they utilize system-wide API hooks (`T1056`) to monitor mouse coordinates and keyboard input. While the program itself may just be a joke (`T1491`), the *method* of delivery is identical to adware, and modern threat actors frequently take popular, open-source Screenmate code and repackage it with hidden cryptominers or infostealers (`T1189`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a loss of productivity, minor system sluggishness, and the potential for secondary malware infection. IoCs are highly visible: unauthorized animated characters moving across the user's screen. EDR logs will flag unsigned executables (often running from the `%Downloads%` folder) making extensive use of `SetWindowsHookEx` to intercept mouse/keyboard input.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1189",
    "T1491",
    "T1056"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (User-initiated download)",
      "tactic": "Execution"
    },
    {
      "id": "T1056",
      "name": "Input Capture (API hooking for interactivity)",
      "tactic": "Collection"
    },
    {
      "id": "T1491",
      "name": "Defacement (Altering the desktop environment)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled secondary payloads)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Terminate the active Screenmate process via the Windows Task Manager.",
    "Locate and delete the executable from the user's local profile (usually `%Downloads%` or the Desktop).",
    "Perform a comprehensive endpoint scan using an enterprise AV/EDR solution to ensure the Screenmate wasn't a trojan horse bundled with actual malware.",
    "Use this incident as an opportunity to reinforce corporate policies regarding the installation of unapproved, unsigned third-party software."
  ],
  "what_to_avoid": [
    "Do not ignore the incident simply because it's a 'joke' program; its presence indicates the user has the ability to download and execute arbitrary, unsigned code.",
    "Avoid assuming the program is benign; always check for hidden secondary payloads dropped during installation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}