Behind The Screen
Difficulty: easy
Topics: T1564.003 - Hide Artifacts: Hidden Window
Problem statement
Scenario: Legitimate Windows applications are executing successfully, yet no visible windows appear on the user's desktop
Process creation appears to be functioning normally, and the applications continue running without any obvious execution failures
Initial investigation has ruled out common process injection techniques and window visibility manipulation
The applications are not simply creating hidden windows or changing their visibility through conventional window-management APIs
Further investigation suggests that the applications may be executing within a graphical environment different from the one currently visible to the user
Your task is to investigate the Windows API activity responsible for this behavior
During your research, pay attention to how Windows exposes API variants for applications that use ANSI and Unicode character encodings
The monitored application uses the ANSI versions of the relevant Win32 APIs
A deeper investigation into Windows Window Stations and Desktop Objects may help you identify the mechanism responsible for this behavior
However, identifying desktop creation alone is not enough
You must also determine how a newly created desktop is selected when another application is launched
Reconstruct the execution sequence by identifying the two relevant API calls and correlating their runtime parameters
Your objective: Determine which APIs are responsible for creating the separate desktop environment and launching a process within it.
How to solve this challenge
Open the in-browser IDE on this page, write your solution in C or C++, and click Run. A sandboxed agent compiles your code and executes it against the target while streaming live stdout, stderr, hook traces, and verification results over a WebSocket. When your implementation succeeds, the flag is surfaced automatically.
Who is this challenge for?
Detection engineers, blue team analysts, malware researchers, security engineers, and operators who want hands-on practice with T1564.003 - Hide Artifacts: Hidden Window.