{
  "family": "desktop",
  "sample_count": 2,
  "category": "ransomware",
  "description": "Behavior:Win32/Desktop is a specialized **Heuristic Detection** that flags unauthorized or highly suspicious modifications to the Windows desktop environment, user interface settings, or `explorer.exe` shell configurations. This behavior is commonly exhibited by ransomware (changing the wallpaper to a ransom note), scareware (locking the screen with fake police warnings), or persistent adware.<br><br><b>Understanding Desktop (UI Hijacking)</b><br>To an end-user, this behavior is immediately obvious and highly disruptive—their wallpaper changes, their icons disappear, or a massive, unclosable window dominates the screen. For a security analyst, this detection indicates that malware is attempting to exert control over the user experience (`T1491`), usually for extortion or aggressive coercion.<br><br><b>Execution and Hijacking Mechanics</b><br>Malware triggers this detection by utilizing specific Windows APIs to manipulate the graphical environment. Ransomware alters the `Wallpaper` registry key (`HKCU\\Control Panel\\Desktop`) to display its demands (`T1491.001`). 'Screenlocker' malware might replace the default Windows shell (`explorer.exe`) in the registry (`HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) with its own malicious executable (`T1547.004`), effectively trapping the user in a full-screen application and preventing access to the taskbar or standard programs.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from severe annoyance (adware) to total endpoint lockout (ransomware/screenlockers). Host-based IoCs include EDR alerts for modifications to the `Winlogon` registry keys, unauthorized changes to the active wallpaper file path, or the injection of code into the `explorer.exe` process (`T1055`). Visual IoCs (the changed desktop itself) are the most immediate indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.004",
    "T1491.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement (Changing the wallpaper)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell hijacking)",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting into explorer.exe)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "If dealing with a screenlocker, reboot the machine into 'Safe Mode with Command Prompt' to bypass the hijacked shell.",
    "Use the Command Prompt or remote Registry tools (like remote Regedit) to restore the `Winlogon\\Shell` key back to `explorer.exe`.",
    "Identify the malicious executable that was configured as the shell or was actively changing the wallpaper, and quarantine it.",
    "Run a comprehensive anti-malware scan to ensure no deeper persistence mechanisms or secondary payloads (like file encryptors) are active."
  ],
  "what_to_avoid": [
    "Do not pay any ransom demanded on the hijacked desktop; there is no guarantee the attackers will unlock the system.",
    "Avoid assuming the threat is gone just because the wallpaper was changed back; the underlying malware must be removed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}