{
  "family": "desktop",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Behavior:Win32/Desktop is a specialized **Heuristic Detection** that flags unauthorized or highly suspicious modifications to the Windows desktop environment, user interface settings, or `explorer.exe` shell configurations. This behavior is commonly exhibited by ransomware (changing the wallpaper to a ransom note), scareware (locking the screen with fake police warnings), or persistent adware.<br><br><b>Understanding Desktop (UI Hijacking)</b><br>To an end-user, this behavior is immediately obvious and highly disruptive—their wallpaper changes, their icons disappear, or a massive, unclosable window dominates the screen. For a security analyst, this detection indicates that malware is attempting to exert control over the user experience (`T1491`), usually for extortion or aggressive coercion.<br><br><b>Execution and Hijacking Mechanics</b><br>Malware triggers this detection by utilizing specific Windows APIs to manipulate the graphical environment. Ransomware alters the `Wallpaper` registry key (`HKCU\\Control Panel\\Desktop`) to display its demands (`T1491.001`). 'Screenlocker' malware might replace the default Windows shell (`explorer.exe`) in the registry (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) with its own malicious executable (`T1547.004`), effectively trapping the user in a full-screen application and preventing access to the taskbar or standard programs.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe annoyance (adware) to total endpoint lockout (ransomware/screenlockers). Host-based IoCs include EDR alerts for modifications to the `Winlogon` registry keys, unauthorized changes to the active wallpaper file path, or the injection of code into the `explorer.exe` process (`T1055`). Visual IoCs (the changed desktop itself) are the most immediate indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Desktop and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Desktop is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Desktop establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Desktop typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Desktop compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Desktop should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Desktop employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Desktop typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Desktop, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Desktop depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.004",
    "T1491.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement (Changing the wallpaper)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking)",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting into explorer.exe)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "If dealing with a screenlocker, reboot the machine into 'Safe Mode with Command Prompt' to bypass the hijacked shell.",
    "Use the Command Prompt or remote Registry tools (like remote Regedit) to restore the `Winlogon\\Shell` key back to `explorer.exe`.",
    "Identify the malicious executable that was configured as the shell or was actively changing the wallpaper, and quarantine it.",
    "Run a comprehensive anti-malware scan to ensure no deeper persistence mechanisms or secondary payloads (like file encryptors) are active."
  ],
  "what_to_avoid": [
    "Do not pay any ransom demanded on the hijacked desktop; there is no guarantee the attackers will unlock the system.",
    "Avoid assuming the threat is gone just because the wallpaper was changed back; the underlying malware must be removed."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}