{
  "family": "vigram",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware/PUP:Win32/Vigram is a prevalent Potentially Unwanted Program (PUP) categorized as Adware. It is designed to monetize the user's web browsing activity without their explicit consent by forcefully injecting intrusive advertisements, pop-unders, and sponsored links directly into the webpages they visit. Vigram significantly degrades system performance and poses privacy risks by tracking browsing history.<br><br><b>Understanding Vigram (Adware)</b><br>To an end-user, Vigram is highly visible: web pages load slowly, words within articles are mysteriously hyperlinked to advertising sites, and unclosable pop-up ads appear constantly. For a security operations center (SOC), Vigram is an indicator of poor user hygiene and risky downloading behavior, serving as a potential gateway for more severe 'Drive-by Compromise' (`T1189`) attacks via malvertising.<br><br><b>Execution and Hijacking Mechanics</b><br>Vigram is typically distributed via deceptive software bundles (wrappers) on third-party freeware sites. Upon execution, it installs itself, often masquerading as a legitimate browser helper object (BHO) or extension (`T1176`). It intercepts HTTP/HTTPS traffic locally to inject its own ad scripts directly into the Document Object Model (DOM) of the webpage before the browser renders it. To ensure it remains active, Vigram establishes persistence via Scheduled Tasks (`T1053.005`) or Registry Run keys (`T1547.001`), frequently employing randomized file names to evade simple signature-based removal scripts.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severe degradation of the user experience and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for anomalous Scheduled Tasks launching browser processes or unknown executables from the `%AppData%` directory. Network IoCs include a massive increase in DNS queries and HTTP connections to known adware affiliate networks, tracking domains, and click-fraud infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1176",
    "T1189",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious add-ons to facilitate ad injection)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Modifying browser settings without consent)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Initial distribution via software bundles)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Utilize the Windows 'Programs and Features' Control Panel to uninstall Vigram and any related software installed concurrently.",
    "Meticulously review the Windows Task Scheduler; Vigram relies heavily on scheduled tasks to reinstall its browser extensions.",
    "Reset all web browsers (Chrome, Edge, Firefox) to their default settings to remove the injected extensions and reset homepages.",
    "Deploy an enterprise-grade PUP/Adware removal tool to locate and clean the randomized, hidden files and registry hooks."
  ],
  "what_to_avoid": [
    "Do not allow users to click on the advertisements generated by Vigram, as they frequently lead to tech support scams or malware.",
    "Avoid trying to manually clean the registry without a specialized tool, as adware often uses complex, randomized keys."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}