{
  "family": "oneinstaller",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Oneinstaller is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler'. Its primary function is to act as an installation wrapper for other software. While it may install a legitimate freeware application the user requested, it deceptively packages and installs multiple other unwanted applications—such as browser hijackers, fake system optimizers, and aggressive adware—to generate pay-per-install revenue for the developers.<br><br><b>Understanding Oneinstaller (Software Bundling)</b><br>To an end-user, executing Oneinstaller looks like a normal software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (a 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Oneinstaller represents a significant risk to endpoint hygiene and a common vector for introducing vulnerabilities (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Oneinstaller is primarily distributed via third-party software download portals (like CNET or Softonic) or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then downloads and silently installs (`T1105`) the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish persistence (`T1547.001`), modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, system slowdowns, and increased attack surface due to the installation of unverified software. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list, new browser extensions, and modified homepage settings. Network IoCs include EDR alerts for a single installer process spawning multiple child processes or making numerous outbound connections to diverse software distribution domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1105",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Deceptive software bundling portals)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the secondary bundled payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to manually uninstall all applications introduced by the bundler (check the 'Installed On' date to group them).",
    "Reset all web browsers (Chrome, Edge, Firefox) to their default settings to clear out any hijacked homepages or malicious extensions.",
    "Run a full system scan with a reputable Adware/PUP removal tool to clean up the registry persistence mechanisms left behind by the bundled payloads.",
    "Implement Application Control (WDAC/AppLocker) or strict standard-user privileges to prevent users from executing unapproved installers."
  ],
  "what_to_avoid": [
    "Do not allow users to download software from unverified third-party portals; always use the official vendor websites.",
    "Avoid assuming that uninstalling the 'primary' application also removes the bundled adware; they must all be uninstalled separately."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}