{
  "family": "driverpack",
  "sample_count": 326,
  "category": "pua",
  "description": "Adware:Win32/Driverpack (often branded as DriverPack Solution) is an intrusive Potentially Unwanted Application (PUA) family that masquerades as a legitimate system utility for updating hardware drivers.<br><br><b>Understanding Driverpack</b><br>To the average user, Driverpack presents itself as a helpful tool to fix computer errors. For incident responders, it is a deceptive monetization scheme and a massive security liability. While it may occasionally install legitimate (albeit often outdated) drivers, its primary purpose is to bundle massive amounts of third-party adware, toolbars, and search hijackers onto the endpoint during the installation process.<br><br><b>Execution and Evasion Strategies</b><br>Driverpack is downloaded voluntarily by users seeking hardware fixes or bundled with other freeware. The execution is characterized by deceptive UI tactics (Dark Patterns). Unless the user explicitly selects 'Expert Mode' and unchecks dozens of hidden boxes, Driverpack will silently install affiliated software. It establishes deep persistence by dropping services and scheduled tasks to initiate daily 'scans'. Furthermore, Driverpack frequently disables UAC and alters Windows Security Center settings to prevent the OS from blocking its unsigned driver installations.<br><br><b>Indicators of Compromise (IoCs)</b><br>The impact is a severely bloated endpoint, compromised search privacy, and extreme system instability (BSODs) caused by forcefully installed, incompatible drivers. Threat hunters will observe a massive spike in outbound HTTP connections to affiliate tracking networks. The Windows Registry will show heavy modifications under <code>HKCU\\Software</code>. EDR tools often flag the software for attempting to load unsigned kernel-mode drivers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1053.005",
    "T1562.001",
    "T1204.002",
    "T1189",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the ongoing downloading of secondary adware modules and potentially incompatible drivers.",
    "Audit the 'Add/Remove Programs' list and methodically uninstall the Driverpack utility and all software installed concurrently.",
    "Utilize the Windows System Restore feature to roll back the registry and drivers to a state prior to the Driverpack installation.",
    "Deploy specialized adware removal tools (like AdwCleaner) to identify and strip deep registry hooks left by the bundled PUPs."
  ],
  "what_to_avoid": [
    "Do not allow users to use third-party driver updaters; enforce strict policies requiring drivers to be sourced only from official OEM websites.",
    "Avoid ignoring the installation; the forced installation of incorrect or unsigned drivers can permanently corrupt the operating system."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}