{
  "family": "installbrain",
  "sample_count": 13,
  "category": "adware",
  "description": "InstallBrain (classified across cybersecurity vendors as Adware:Win32/InstallBrain and PUA:Win32/InstallBrain) is an aggressive pay-per-install software bundler and adware distribution framework. Bundled with free games, codec packs, and utility downloads, InstallBrain tricks users through deceptive multi-step installation wizards where unwanted third-party software (browser hijackers, shopping toolbars, and system monitors) is selected by default with obscured decline options. InstallBrain modifies browser homepages and search providers across Chrome, Firefox, and Edge, injects advertising banners into web sessions, and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/InstallBrain",
    "PUA:Win32/InstallBrain",
    "Program:Win32/InstallBrain",
    "InstallBrain Bundler",
    "Win32/InstallBrain"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/InstallBrain?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "InstallBrain is a software bundler that wraps third-party freeware to inject adware and browser modifiers during installation."
      }
    },
    {
      "@type": "Question",
      "name": "How does InstallBrain mislead users during installation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses confusing multi-step wizards where opt-out checkboxes for unwanted third-party toolbars and adware are hidden."
      }
    },
    {
      "@type": "Question",
      "name": "What unwanted changes are made to browsers by InstallBrain?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It alters default search engines, changes homepages to affiliate portals, and injects commercial advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does InstallBrain establish persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under Windows Run keys and registers background updater tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove InstallBrain?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall bundled applications via Windows Settings, reset browser search configurations, and run an updated antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.004",
      "name": "Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch)",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to systematically identify and uninstall all recently added programs, focusing on toolbars and 'search protectors'.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to strip the deeply embedded Scheduled Tasks and registry hooks left behind by the adware framework.",
    "Force a complete reset of all installed web browsers (Chrome, Edge, Firefox) to factory defaults to eradicate rogue extensions and restore the homepage.",
    "Quarantine the original installer file to prevent further execution."
  ],
  "what_to_avoid": [
    "Do not rely solely on manual uninstallation via the Control Panel; the payloads frequently use watchdog services to immediately reinstall themselves.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or provide a foothold for more severe malvertising attacks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/InstallBrain",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/InstallBrain"
    },
    {
      "name": "Trend Micro Security Research - PUA.Win32.InstallBrain Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pua.win32.installbrain"
    },
    {
      "name": "MITRE ATT&CK - Browser Extensions (T1176)",
      "url": "https://attack.mitre.org/techniques/T1176/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}