Desktop

Overview

Behavior:Win32/Desktop is a specialized **Heuristic Detection** that flags unauthorized or highly suspicious modifications to the Windows desktop environment, user interface settings, or `explorer.exe` shell configurations. This behavior is commonly exhibited by ransomware (changing the wallpaper to a ransom note), scareware (locking the screen with fake police warnings), or persistent adware.

Understanding Desktop (UI Hijacking)
To an end-user, this behavior is immediately obvious and highly disruptive—their wallpaper changes, their icons disappear, or a massive, unclosable window dominates the screen. For a security analyst, this detection indicates that malware is attempting to exert control over the user experience (`T1491`), usually for extortion or aggressive coercion.

Execution and Hijacking Mechanics
Malware triggers this detection by utilizing specific Windows APIs to manipulate the graphical environment. Ransomware alters the `Wallpaper` registry key (`HKCU\Control Panel\Desktop`) to display its demands (`T1491.001`). 'Screenlocker' malware might replace the default Windows shell (`explorer.exe`) in the registry (`HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell`) with its own malicious executable (`T1547.004`), effectively trapping the user in a full-screen application and preventing access to the taskbar or standard programs.

Indicators of Compromise & Impact
The impact ranges from severe annoyance (adware) to total endpoint lockout (ransomware/screenlockers). Host-based IoCs include EDR alerts for modifications to the `Winlogon` registry keys, unauthorized changes to the active wallpaper file path, or the injection of code into the `explorer.exe` process (`T1055`). Visual IoCs (the changed desktop itself) are the most immediate indicator.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_DESKTOP_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Desktop"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "desktop" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Desktop (Ransomware) Execution & Triage
id: d4a15701-5eb5-5d59-94d8-edf500f13d2a
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Desktop malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/desktop
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1547_004
- attack.t1491_001
- attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_DESKTOP_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Desktop tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "desktop" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. If dealing with a screenlocker, reboot the machine into 'Safe Mode with Command Prompt' to bypass the hijacked shell.
2. Use the Command Prompt or remote Registry tools (like remote Regedit) to restore the `Winlogon\Shell` key back to `explorer.exe`.
3. Identify the malicious executable that was configured as the shell or was actively changing the wallpaper, and quarantine it.
4. Run a comprehensive anti-malware scan to ensure no deeper persistence mechanisms or secondary payloads (like file encryptors) are active.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not pay any ransom demanded on the hijacked desktop; there is no guarantee the attackers will unlock the system.
2. Avoid assuming the threat is gone just because the wallpaper was changed back; the underlying malware must be removed.

References & External Analysis

• Search "desktop" on VirusTotal (External Analysis)
• Search "desktop" on Any.Run (Sandbox Sandbox)
• Search "desktop" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Thoper
• Sasquor
• Ghoul
• Tanspy
• Shufab
• Truew
• Recex
• Downloaderb

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/desktop.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.