{
  "family": "wintaskad",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "Adware:Win32/Wintaskad represents a family of highly aggressive advertising software (Adware or PUP) that relies on the Windows Task Scheduler (`T1053.005`) for persistence. Unlike simple browser extensions that only show ads when the user is surfing the web, Wintaskad ensures that intrusive, full-screen advertisements or browser redirects are launched on a set schedule, even if the user isn't actively using the computer.<br><br><b>Understanding Wintaskad (Scheduled Persistence)</b><br>To an end-user, Wintaskad is infuriating. Their default browser will suddenly launch itself in the middle of a presentation or while playing a game, forcing them to a spam, survey, or malvertising website. For an IT department, this indicates a failure of endpoint security, usually caused by the user installing bundled 'freeware' or cracking tools.<br><br><b>Execution and Persistence Mechanics</b><br>During its covert installation (`T1204.002`), Wintaskad drops its executables (often heavily obfuscated) into hidden folders within `%AppData%` or `ProgramData`. The critical step is the creation of multiple Windows Scheduled Tasks. These tasks are configured to trigger the adware payload periodically (e.g., every 30 minutes, or at system idle). The tasks often use native tools (like `cmd.exe` or `powershell.exe`) to launch a URL, making the execution look slightly more legitimate to basic AV.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe disruption and exposure to secondary infections via malicious ads. Host-based IoCs are centered entirely around the Windows Task Scheduler (`schtasks.exe`). Look for unexpected tasks with names like 'System Update Service', 'Chrome Optimizer', or random GUID strings. The actions for these tasks will reveal commands pointing to suspicious executables or direct URLs to advertising networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1204.002",
    "T1053.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task (The defining characteristic of this adware family)",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (The risk posed by the ads forced upon the user)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (The initial infection vector via bundled software)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Open the Windows Task Scheduler (`taskschd.msc`) and manually audit all active tasks, looking for suspicious actions or triggers.",
    "Use `schtasks /query /fo LIST /v` from an administrative command prompt to export all task details for analysis.",
    "Delete the malicious scheduled tasks, then locate and remove the associated executable files from the user's profile.",
    "Run a thorough scan with a dedicated anti-malware/anti-PUP tool to remove any remaining registry hooks."
  ],
  "what_to_avoid": [
    "Do not simply delete the adware executable without removing the Scheduled Task; Windows will throw constant 'file not found' errors on the schedule.",
    "Avoid trusting the names of the scheduled tasks, as they are specifically designed to look like legitimate Windows or Google updaters."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}