{
  "family": "installpack",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "Adware:Win32/Installpack is a generic classification for highly aggressive Software Bundlers and Pay-Per-Install (PPI) monetizers. These are the engines that drive the distribution of Potentially Unwanted Programs (PUAs), adware, and sometimes actual malware, by wrapping legitimate freeware in a deceptive, payload-laden installation wrapper.<br><br><b>Understanding the Installpack Threat</b><br>To an end-user, they believe they are simply downloading a free PDF reader or media player. For a security analyst, an Installpack detection indicates a failure of security awareness and the introduction of multiple unknown variables into the environment. The primary danger of Installpack is not the wrapper itself, but the multiple, often highly persistent payloads it silently drops on the system.<br><br><b>Execution and Bundling Mechanics</b><br>Installpack wrappers are distributed heavily via SEO poisoning (ranking high when users search for free software) and malvertising (`T1189`). During execution (`T1204.002`), the installer employs 'Dark Patterns'—hiding the adware installation behind 'Express Install' or 'Advanced Options' buttons, pre-checking boxes to install secondary software. As the primary (legitimate) software installs, the Installpack silently reaches out to its C2 network to pull down the most profitable current payloads (adware extensions, scareware, browser hijackers). It then executes these secondary installers (`T1105`), resulting in a cascade of unauthorized system modifications, registry hooks (`T1547.001`), and rogue browser extensions (`T1176`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a massively degraded user experience, browser hijacking, and a high risk of secondary severe infections. IoCs include EDR alerts for the execution of unsigned installers from the `%Downloads%` folder, followed immediately by the creation of multiple unknown processes and the modification of browser registry keys (`HKLM\\SOFTWARE\\Policies\\Google\\Chrome`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1176",
    "T1189",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers via SEO poisoning)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading secondary adware payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions (Bundled adware extensions)",
      "tactic": "Persistence"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to uninstall all unexpected software that was installed on the exact date and time the Installpack was executed.",
    "Deploy an enterprise PUA/Adware removal tool to locate and strip the secondary payload registry hooks and rogue browser extensions.",
    "Force a complete reset of all installed web browsers to factory defaults to clear the altered JSON preference files.",
    "Remind users of the corporate Acceptable Use Policy regarding the installation of unapproved freeware from third-party sites."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean just because the main downloaded application was uninstalled; the bundled payloads persist independently.",
    "Avoid ignoring the alert; PPI networks frequently rotate their payloads and may eventually drop severe malware like infostealers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}