The Metasploit screen_spy module records the user's screen by screenshot'ing the user desktop.

Screenshots are taken using the following Windows API functions:

// get handle to necessary GUI/window objects
OpenInputDesktop
GetThreadDesktop
SetThreadDesktop
GetDesktopWindow

// get device context (i.e. metadata describing the desktop image)

GetDC

// convert device-context metadata into an image file
CreateCompatibleBitmap

Screenshots do not appear to be dropped to disk; instead, the screenshots are stored in a buffer in memory, and are sent to the attack platform over the Meterpreter C2 channel.

This module closely emulates the screen-recording implementation seen in Carbanak-malware source code.

1. https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/espia/screen.c

2. https://github.com/Aekras1a/Updated-Carbanak-Source-with-Plugins/blob/d40434bfa3933b5980babfb1f5552659d73e7b9d/Carbanak%20-%20part%201/botep/WndRec/source/video.cpp

3. https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-getdc

This step is intended to emulate FIN7's use of the RDFSNIFFER malware.

We inject the Meterpreter keylogger into process memory of mstsc.exe, which is the RDP client.

1. https://github.com/rapid7/metasploit-payloads/blob/18ed237c1d9ae70030d1b01e64eb67b2c75fa9db/c/meterpreter/source/extensions/stdapi/server/ui/keyboard.c