Crowdstrike antivirus flags ScreenToGif.dll as virus about screentogif

[NickeManarin]

[NickeManarin]

I sent a message to the company, let's see if they give me a reply.

[DavidMulder0]

Tip: When you install through the Microsoft Store it actually works just fine... 😕 No idea what that says about CrowdStrike, but at least a workaround for those who want to use ScreenToGif 👍.

[captainhunt]

Well just as long as your company does not block MS store, too 😕.

[mattspierce]

Also, I did a test with the current version against my CS client and did not get blocked. I will remove the IOC exception and see if my users are impacted.

[Vincent-FundApps]

+1

[TrevisanGMW]

+1

[mattspierce]

I've had a few user experiencing this. Here are the details of the detection.

DETECT TIME
Dec. 17, 2023 12:48:24
HOSTNAME
computername
HOST TYPE
Workstation
USER NAME
place\user
ACTIONS TAKEN
Process blocked
File quarantined
SEVERITY
Low
OBJECTIVE
Falcon Detection Method
TACTIC & TECHNIQUE
Malware via PUP
TECHNIQUE ID
CST0013
SPECIFIC TO THIS DETECTION
This file is classified as Adware/PUP based on its SHA256 hash.
TRIGGERING INDICATOR
Associated IOC (SHA256 on library/DLL loaded)
ad17b9409ac2b46f54c5fbd220d48d091ca7a1b8d91c20f15b00b93c6f6ca69d
GLOBAL PREVALENCE
Common
LOCAL PREVALENCE
Low
IOC MANAGEMENT ACTION
None

Associated File
\Device\HarddiskVolume6\Program Files\ScreenToGif\ScreenToGif.exe
GROUPING TAGS
None
LOCAL PROCESS ID
26000
COMMAND LINE
"C:\Program Files\ScreenToGif\ScreenToGif.exe"
FILE PATH
\Device\HarddiskVolume6\Program Files\ScreenToGif\ScreenToGif.exe
EXECUTABLE SHA256
ad17b9409ac2b46f54c5fbd220d48d091ca7a1b8d91c20f15b00b93c6f6ca69d
GLOBAL PREVALENCE
Common
LOCAL PREVALENCE
Low
IOC MANAGEMENT ACTION
None

EXECUTABLE MD5
ce227688fe0d35e6b5381666dc1cd7db
RUN PERIOD
START TIME
Dec. 17, 2023 12:47:14
END TIME
Dec. 17, 2023 12:47:15
DURATION
Terminated

[jduke-halls]

Just had a trigger with the new version

Steps to reproduce detection:

• Download ScreenToGif Portable from link at screentogif.com
  • https://github.com/NickeManarin/ScreenToGif/releases/download/2.40.1/ScreenToGif.2.40.1.Portable.x64.zip
• Extract ScreenToGif.exe
• Run ScreenToGif.exe

Metadata from Crowdstrike Detection

ACTIONS TAKEN
Process blocked
File quarantined

SEVERITY
Low

OBJECTIVE
Falcon Detection Method

TACTIC & TECHNIQUE
Malware via PUP

TECHNIQUE ID
CST0013

SPECIFIC TO THIS DETECTION
This file is classified as Adware/PUP based on its SHA256 hash.

TRIGGERING INDICATOR
Associated IOC (SHA256 on library/DLL loaded)
fe13f363f2c5940eb7010eeee25763575b86d945fa7d70f54c2cce9c4c6f54c6

GLOBAL PREVALENCE
Common

LOCAL PREVALENCE
Unique

IOC MANAGEMENT ACTION
None

Associated File
\Device\HarddiskVolume3\Apps\ScreenToGif.exe

VirusTotal has no detections https://www.virustotal.com/gui/file/fe13f363f2c5940eb7010eeee25763575b86d945fa7d70f54c2cce9c4c6f54c6/detection

HybridAnalysis doesn't have a sample: https://www.hybrid-analysis.com/sample/fe13f363f2c5940eb7010eeee25763575b86d945fa7d70f54c2cce9c4c6f54c6

What we did

We created a group in Falcon for those who can run ScreenToGif and tagged the computers to allow an exception to *\ScreenToGif.exe

[mcd92]

Same thing here. Antivirus McAfee.

[elliottttttttt]

I sent a message to the company, let's see if they give me a reply.

We have the same issue and have asked our CrowdStrike TAM to assist. Hoping that you receive some assistance back from the vendor. In case it's helpful we've raised support case # 01326126 on our end for misidentification as a PUP.

[chrispy-snps]

@NickeManarin - I hope we are able to resolve this. I am impacted too.

[mattspierce]

I would love for this issue to be resolved. The detection was heuristic. I am curious if this FP submission works with the AI engines or just a hash check. Do we know what was added to the code in mid December that triggered the alerts?

[NickeManarin]

I got this details from some other company, they got these results:

YARA signature "Bolonyokte" matched file "sample.bin" as "UnknownDotNet RAT - Bolonyokte" (Author: Jean-Philippe Teissier / @Jipe_) YARA
 signature "MALWARE_Win_AgentTeslaV3" matched file "sample.bin" as "AgentTeslaV3 infostealer payload" (Author: ditekSHen)

and

 "ScreenToGif.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShe l\v1.0\powershe l.exe" (Handle: 1728)

YARA Bolonyokte is a really generic rule-set as for example, it matches apps with "CaptureScreen" and "CaptureCursor" which of course this app would have. 🙄

[NickeManarin]

mid December that triggered the alerts?

I can check, but the code base was mostly unchanged during the last 2 quarters of 2023.

[NickeManarin]

This should no longer be a problem, as the company removed the false-positive.

[p1r473]

@NickeManarin Nope its still flagging for me here as of May 5
Hash
aaa562c84f22ea0fc63d3fef74ee4c4fbb26d873c3b609555e2870008c01c98c