{
  "family": "defaulttab",
  "sample_count": 2,
  "category": "trojan",
  "description": "Adware:Win32/Defaulttab is a particularly aggressive and persistent Potentially Unwanted Program (PUP) categorized as a Browser Hijacker. It is notorious for not just changing the user's default search engine and homepage to a revenue-generating portal, but for employing rootkit-like techniques to actively defend its registry keys and files against removal attempts by both users and standard antivirus software.<br><br><b>Understanding Defaulttab (Aggressive Adware)</b><br>To an end-user, Defaulttab makes the browser completely unusable, constantly redirecting searches and spawning pop-ups. Every attempt to manually change the settings back is instantly reverted. For a security analyst, it represents a complex removal challenge, demonstrating that adware can utilize the same advanced defense evasion techniques as high-level trojans (`T1562.001`).<br><br><b>Execution and Persistence Mechanics</b><br>Defaulttab is primarily distributed through deceptive software bundling (`T1189`). Upon execution, it installs malicious extensions into Chrome, Firefox, and Internet Explorer. Crucially, it establishes deep persistence by installing a Windows Service (`T1543.003`) or a scheduled task that acts as a 'watchdog'. This watchdog process continuously monitors the specific registry keys controlling the browser's homepage and default search provider (`T1112`). If an antivirus program or the user attempts to delete or modify these keys, the watchdog process instantly restores them to the hijacked values.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe disruption of productivity and exposure to potentially malicious third-party advertisements. Host-based IoCs include the presence of the `Defaulttab` process running in Task Manager, a suspicious newly registered Windows Service, and EDR alerts for continuous, rapid modifications to browser registry keys (e.g., `HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Start Page`). Network IoCs include DNS requests resolving to known adware tracking domains and forced search redirects.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1562.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Actively defending its registry keys)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Watchdog persistence)",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Hijacking browser configurations)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Reboot the infected machine into 'Safe Mode' to prevent the Defaulttab watchdog service from loading during remediation.",
    "Use `services.msc` or Autoruns to identify and disable the malicious Windows Service protecting the adware.",
    "Run a full scan with a specialized Adware/PUP removal tool to permanently delete the registry keys, extensions, and watchdog executables.",
    "Reset all installed web browsers to their default settings to clear out the hijacked search providers and homepages."
  ],
  "what_to_avoid": [
    "Do not attempt manual registry edits while booted in normal Windows mode; the watchdog process will instantly revert your changes.",
    "Avoid relying solely on the browser's built-in extension manager to remove Defaulttab, as the persistence mechanism exists outside the browser."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}