{
  "family": "restoro",
  "sample_count": 8,
  "category": "advanced_threat",
  "description": "Rogue:Win32/Restoro is a highly prevalent Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is designed to deliberately mislead the user into believing their computer is severely infected with malware, plagued with critical registry errors, or suffering from failing hardware. The ultimate goal is to panic the user into purchasing a fraudulent 'premium' license to fix these non-existent issues.<br><br><b>Understanding Restoro Scareware</b><br>To an end-user, Restoro is terrifying. Suddenly, their screen is filled with flashing red alerts, terrifying system warnings, and constant pop-ups claiming their hard drive is crashing. For a security analyst, this is a social engineering attack disguised as software. The software itself is largely harmless to the OS (it doesn't steal data or encrypt files), but it severely disrupts productivity and attempts to extort money from the user via credit card fraud.<br><br><b>Execution and Deception Mechanics</b><br>Restoro is typically installed via deceptive malvertising (fake 'Your PC is Infected!' banners) or bundled with freeware (`T1189`). Upon execution (`T1204.002`), it establishes persistence via the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` registry key so it launches every time the computer boots (`T1547.001`). It then initiates a 'scan' of the system. Regardless of the actual health of the computer, the scan is hardcoded to return hundreds of critical errors (`T1562`). It heavily utilizes the Windows UI to generate intrusive, uncloseable pop-up warnings, often disabling the Task Manager (`T1562.001`) to prevent the user from terminating the application easily.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe user panic, complete loss of productivity, and potential financial fraud if the user inputs their credit card. IoCs include EDR alerts for the installation of known rogue software binaries (e.g., `Restoro.exe`). Host-based indicators include the sudden appearance of aggressive system-tray alerts and the unauthorized modification of registry keys intended to disable administrative tools.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1189",
    "T1204.002",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Fake antivirus malvertising)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Disabling Task Manager to prevent closure)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "If the software has locked the screen or disabled Task Manager, reboot the computer into Safe Mode.",
    "Use the Windows Control Panel to uninstall the Restoro software, though be aware it often leaves persistent registry hooks behind.",
    "Deploy an enterprise adware/PUA removal tool to strip the remaining registry entries and ensure the software does not launch on the next boot.",
    "If the user entered their credit card information into the software, instruct them to contact their bank immediately to report fraud."
  ],
  "what_to_avoid": [
    "Do not believe the alerts generated by the software; the system is not failing, the software is lying.",
    "Avoid assuming standard antivirus will easily remove it; scareware often uses watchdog services to resist basic uninstallation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}