{
  "family": "imestartup",
  "sample_count": 9,
  "category": "advanced_threat",
  "description": "BrowserModifier:Win32/Imestartup is a persistent Potentially Unwanted Program (PUA) and browser hijacker specifically designed to forcefully alter a user's web browser settings. It locks the default homepage, new tab page, and search engine to a specific, monetized affiliate portal (often associated with aggressive Input Method Editors or Chinese freeware networks), making it extremely difficult for the user to revert the changes.<br><br><b>Understanding Imestartup Hijackers</b><br>To an end-user, an Imestartup infection is maddening. No matter how many times they manually change their homepage back to Google, it reverts to the unwanted portal upon the next reboot. For security analysts, this represents a sophisticated hijacking attempt. The software utilizes deep OS-level hooks, often abusing legitimate Windows features like Group Policy Objects (GPOs), to enforce its settings on the browser.<br><br><b>Execution and Hijacking Mechanics</b><br>Imestartup is typically distributed as a bundled payload alongside free software, particularly third-party language tools or media players (`T1189`). During installation, it actively searches the system for installed browsers (Chrome, Edge, Firefox). It doesn't just install an extension; it fundamentally alters the browser's core configuration files (like Chrome's `Preferences` JSON) (`T1112`). Crucially, to prevent the user from fixing it, Imestartup often establishes local Windows Group Policies (`T1562.001`) that 'manage' the browser, grey-out the homepage settings in the UI, and force the browser to always open the malicious URL.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience and the redirection of all search traffic through a monetized, potentially insecure affiliate network. Incident responders will observe users complaining about locked browser settings. EDR logs will flag the modification of browser preference files and, most importantly, the unauthorized creation of new registry keys under `HKLM\\Software\\Policies\\Google\\Chrome` (or similar browser policy paths).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1189",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry (Altering browser configurations)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Abusing GPOs to lock settings)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to uninstall the primary software bundle that delivered the hijacker.",
    "Critically, audit the Windows Registry (specifically the `Policies` hives) and delete any unauthorized Group Policies enforcing homepage or search settings.",
    "Deploy an enterprise adware removal tool to strip any remaining registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to clear the altered JSON preference files."
  ],
  "what_to_avoid": [
    "Do not rely on simply changing the homepage in the browser settings GUI; the GPO will instantly override it on the next launch.",
    "Avoid ignoring the infection; forced search routing can expose users to secondary malvertising and phishing attacks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}