{
  "family": "installm",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Installm is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installation conduit for other software. While it may install a legitimate freeware application the user intended to download, its deceptive core purpose is to silently package and install multiple other unwanted applications—such as browser hijackers, fake system optimizers, and aggressive adware—to generate pay-per-install revenue.<br><br><b>Understanding Installm (Software Bundling)</b><br>To an end-user, executing Installm looks like a normal, albeit cluttered, software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (employing 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Installm represents a significant risk to endpoint hygiene and a primary vector for introducing vulnerabilities and data-tracking components (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Installm is heavily distributed via third-party software download portals or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then communicates with its backend servers (`T1105`) to download and silently install the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish their own persistence (`T1547.001`), aggressively modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, massive system slowdowns, and increased attack surface. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list occurring at the exact same timestamp, new browser extensions, and hijacked homepage settings. Network IoCs include EDR alerts for a single installer process (`installm.exe`) spawning multiple child setup processes or making numerous outbound connections to diverse software distribution domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1189",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Deceptive software bundling portals)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the secondary bundled payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to manually uninstall all applications introduced by the bundler (sort by 'Installed On' date to group them).",
    "Reset all web browsers (Chrome, Edge, Firefox) to their default settings to clear out any hijacked homepages or malicious extensions.",
    "Run a full system scan with a reputable Adware/PUP removal tool to clean up the registry persistence mechanisms left behind by the payloads.",
    "Implement Application Control (WDAC/AppLocker) or strict standard-user privileges to prevent users from executing unapproved installers."
  ],
  "what_to_avoid": [
    "Do not allow users to download software from unverified third-party portals; always enforce the use of official vendor websites.",
    "Avoid assuming that uninstalling the 'primary' application also removes the bundled adware; they are independent installations."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}