Default Windows Wallpaper Check

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. In this particular case, the malware checks to see if the wallpaper set on the machine is the default Windows wallpaper.

Technique Identifier

U1351

Evasion Categories

Sandbox Evasion

Code Snippets

package main
import (
	"golang.org/x/sys/windows/registry"
	"fmt"
)

func main() {
	k, err := registry.OpenKey(registry.CURRENT_USER, `CONTROL Panel\\Desktop`, registry.QUERY_VALUE)
	if err != nil {
		fmt.Println(err)
	}
	defer k.Close()

	s, _, err := k.GetStringValue("Wallpaper")
	if err != nil {
		fmt.Println(err)
	}

	if (s == "C:\\Windows\\web\\wallpaper\\Windows\\img0.jpg") {
		fmt.Println("[+] Default wallpaper detected! Possible sandbox/VM...")
	} else {
		fmt.Println("[+] Wallpaper isn't set to default. Continuing checks...")
	}
}

About Author Open Snippet

Author: Issac Briones (1d8) / Target Platform: Windows

Contributor

Issac Briones (1d8)

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Virtualization/Sandbox Evasion: User Activity Based Checks, Sub-technique T1497.002 - Enterprise | MITRE ATT&CK®

Created

December 3, 2024

Last Revised

March 24, 2026