Screen

Overview

Executive Summary

Infection Vector and Lock Mechanisms

• Interface Hijacking: The malware forces a full-screen application to the foreground, completely obscuring the Windows desktop. It actively disables keyboard shortcuts (like Alt+Tab, Ctrl+Alt+Del, and the Windows Key) to prevent the user from closing the lock screen or accessing the Task Manager.
• Psychological Coercion: The lock screen typically displays a highly intimidating message. A common tactic involves masquerading as a local law enforcement agency (e.g., the FBI or local police), accusing the victim of downloading illegal content, and demanding a "fine" to be paid via untraceable methods like prepaid gift cards or cryptocurrency.
• Persistence: The malware modifies registry keys (such as `Winlogon\Shell`) to ensure the lock screen launches immediately upon system reboot, before the legitimate `explorer.exe` process can start.

Threat Assessment

Remediation and Eradication

• Safe Mode Boot: The primary remediation tactic is to reboot the infected machine into "Safe Mode with Command Prompt." This bypasses the malware's registry persistence hooks, allowing an administrator to manually delete the malicious executable and repair the `Winlogon` registry keys.
• Offline Scanning: If Safe Mode is also locked, the machine must be booted from a clean, offline Antivirus Rescue USB drive to scan and remove the infection without loading the compromised host operating system.
• Do Not Pay: Payment should never be made. It funds criminal enterprise, and there is no guarantee the attackers will provide the unlock code.

Known aliases

Threat reports may refer to this family under multiple names:

• Trojan-Ransom.Win32.Screen
• ScreenLocker
• Winlock

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1486 T1112 T1489

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SCREEN {
    meta:
        description = "Detects Screen (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "screen" ascii wide nocase
        $s2 = "trojan-ransom.win32.screen" ascii wide nocase
        $s3 = "screenlocker" ascii wide nocase
        $s4 = "winlock" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Screen Activity
id: 599eba19aa93a929cb8589f148b8a6c4
status: experimental
description: Detects generic indicators of the screen malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*screen*"
            - "*trojan-ransom.win32.screen*"
            - "*screenlocker*"
            - "*winlock*"
    condition: selection
level: medium

References & External Analysis

• Search "screen" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Sahat
• Scomma
• Neurevt
• Sixmuch
• Msilbot

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/screen.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.