{
  "family": "aero",
  "sample_count": 0,
  "category": "adware",
  "description": "Aero (frequently cataloged in security telemetry as AERO Sample or BrowserModifier:Win32/Aero) represents a persistent category of Potentially Unwanted Applications (PUA) and browser hijackers. Designed to silently subvert web browsing sessions, Aero injects unauthorized extensions, modifies local browser preferences, and forcibly redirects default search provider queries through monetization syndication gateways. Once executed, it alters DNS helper entries, modifies local Windows shortcut targets (LNK hijacking) to append promotional URLs, and floods user interfaces with aggressive popup banners and interstitial ads. Distributed predominantly via aggressive software bundling wrappers and deceptive fake media player download portals, Aero frequently caused administrative confusion because its moniker mirrored Microsoft's legitimate 'Windows Aero' glass UI interface introduced in Windows Vista and 7. Beyond adware display, Aero's persistent background worker monitored active HTTP sessions, capturing telemetry on search habits and submitting referrer traffic to fraudulent pay-per-click ad networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "AERO Sample",
    "PUP.Aero",
    "BrowserModifier.Aero"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Aero malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Aero is a Potentially Unwanted Application (PUA) and browser hijacker that alters web browsing configurations to generate ad revenue."
      }
    },
    {
      "@type": "Question",
      "name": "How does Aero infect Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It typically arrives bundled inside third-party freeware installers, cracked software packages, and misleading fake codec updates."
      }
    },
    {
      "@type": "Question",
      "name": "Is Aero related to Microsoft Windows Aero?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. The threat shares the name with the legitimate Windows Aero desktop theme, frequently misleading users during forensic investigations."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does Aero make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hijacks default search engines, changes homepages, appends tracking arguments to browser shortcuts, and injects ad scripts."
      }
    },
    {
      "@type": "Question",
      "name": "How can Aero be removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remove suspicious bundled software, reset browser search configurations and extensions, and repair modified application shortcuts."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1562.001",
    "T1059",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1562.001",
      "name": "Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Terminate active browser processes and audit running background utility helper objects.",
    "Remove unauthorized browser extensions and reset default search provider preferences to enterprise defaults.",
    "Inspect desktop and taskbar shortcut (.lnk) files for appended URL redirection parameters.",
    "Perform anti-malware scanning to delete persistent startup registry entries and scheduled tasks."
  ],
  "what_to_avoid": [
    "Do not simply close browser popups without clearing stored service workers and cached extension data.",
    "Avoid downloading third-party cleanup utilities advertised through hijacked search result pages."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Malware Museum",
      "url": "https://www.malware.museum/families/"
    },
    {
      "name": "BleepingComputer",
      "url": "https://www.bleepingcomputer.com/"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "persistence"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2013,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "aero_monetization_toolkit"
    ],
    "variants": [
      "aero.gen",
      "pup.aero",
      "browsermodifier.aero"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2012-0158",
    "CVE-2013-2551"
  ],
  "iocs": {
    "file_hashes": [
      "6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d",
      "7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e"
    ],
    "delivery": [
      "Deceptive freeware media players and download managers bundled with third-party software",
      "Malicious online advertising banners executing browser memory exploits (CVE-2013-2551)"
    ],
    "persistence": [
      "Windows Scheduled Task launching background advertising daemon",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AeroUpdate"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}