{
  "family": "installerex",
  "sample_count": 43,
  "category": "ransomware",
  "description": "Adware:Win32/Installerex is a highly prevalent, aggressive software bundler and adware framework. It is designed to hijack the installation process of legitimate freeware applications to silently inject multiple, unwanted third-party programs, toolbars, and browser extensions onto a user's system.<br><br><b>Understanding Installerex</b><br>To the end-user, Installerex is deeply deceptive. They believe they are downloading a free media player or PDF tool. During installation, if they rapidly click 'Next', Installerex leverages 'Dark Patterns' to install a massive payload of adware. The browser homepage is hijacked, system performance degrades, and pop-up ads flood the screen. For security analysts, Installerex is a 'Pay-Per-Install' (PPI) monetization engine. It acts as a gateway; while not inherently destructive like ransomware, it deliberately lowers the security posture of the endpoint by forcing the installation of numerous poorly-coded, invasive tracking tools.<br><br><b>Execution and Evasion Strategies</b><br>Installerex wrappers are hosted on third-party freeware download sites. Upon execution, the framework communicates with its backend C2 server (`T1105`) to determine which adware payloads will yield the highest affiliate payout for that specific region and operating system. It presents misleading EULAs and pre-checked consent boxes (`T1204.002`). The installed adware payloads establish deep persistence via Registry Run keys, Scheduled Tasks, and Browser Helper Objects (BHOs). They frequently modify browser shortcut properties (`T1546.015`) to ensure the hijacked homepage loads even if the user resets their browser settings.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a compromised, unstable endpoint flooded with tracking telemetry. Incident responders will observe a massive spike in HTTP/HTTPS traffic to known advertising and PPI tracking networks. EDR logs will show the single initial installer spawning multiple child processes (`msiexec.exe`, `setup.exe`) dropping dozens of distinct files into `Program Files` and `AppData`. The sudden appearance of unknown browser extensions and modified LNK files on the desktop are definitive IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1204.002",
    "T1189",
    "T1546.015",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546.015",
      "name": "Event Triggered Execution: Component Object Model Hijacking",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active downloading of further adware modules from the PPI network.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to systematically strip the deeply embedded registry hooks, BHOs, and watchdog services.",
    "Audit Windows Group Policies and all browser configurations, performing a complete factory reset of Chrome, Firefox, and Edge.",
    "Manually inspect all desktop and taskbar shortcuts (.LNK files) for web browsers, removing any malicious arguments appended to the target path."
  ],
  "what_to_avoid": [
    "Do not rely solely on the 'Add/Remove Programs' menu; Installerex payloads frequently use rootkit techniques to hide their uninstallers.",
    "Avoid ignoring the infection as a mere annoyance; the adware actively tracks browsing data and may expose internal corporate portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}