{
  "family": "installermonetizer",
  "sample_count": 14,
  "category": "adware",
  "description": "InstallerMonetizer (classified across cybersecurity vendors as Adware:Win32/InstallerMonetizer and PUA:Win32/InstallerMonetizer) is a software monetizing pay-per-install bundler framework. Distributed by packaging open-source or free applications (such as media players, PDF readers, and torrent tools) inside an ad-injecting wrapper, InstallerMonetizer deceives users into installing multiple unwanted third-party toolbars, browser modifiers, and cryptocurrency miners. It communicates with affiliate marketing networks, modifying browser search providers, homepage preferences, and desktop shortcuts, while collecting device telemetry and user search patterns.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/InstallerMonetizer",
    "PUA:Win32/InstallerMonetizer",
    "Program:Win32/InstallerMonetizer",
    "InstallerMonetizer Bundler",
    "Win32/InstallerMonetizer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/InstallerMonetizer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "InstallerMonetizer is an adware bundler that wraps free software to surreptitiously install toolbars, browser hijackers, and promotional adware."
      }
    },
    {
      "@type": "Question",
      "name": "How does InstallerMonetizer deceive users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses deceptive installation wizards with pre-checked consent boxes and hidden decline options for bundled components."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does InstallerMonetizer make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It replaces search engines, alters homepages, injects advertising extensions, and modifies browser desktop shortcuts."
      }
    },
    {
      "@type": "Question",
      "name": "How does InstallerMonetizer maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates background service executables, registers daily scheduled tasks, and creates registry Run keys."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove InstallerMonetizer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall bundled utilities from Windows Settings, reset browser search engines and extensions, and run a malware remediation scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.004",
      "name": "Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch)",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to systematically identify and uninstall all recently added programs, focusing on toolbars and 'search protectors'.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to strip the deeply embedded Scheduled Tasks and registry hooks left behind by the adware framework.",
    "Force a complete reset of all installed web browsers (Chrome, Edge, Firefox) to factory defaults to eradicate rogue extensions and restore the homepage.",
    "Quarantine the original installer file to prevent further execution."
  ],
  "what_to_avoid": [
    "Do not rely solely on manual uninstallation via the Control Panel; the payloads frequently use watchdog services to immediately reinstall themselves.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or provide a foothold for more severe malvertising attacks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/InstallerMonetizer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/InstallerMonetizer"
    },
    {
      "name": "Trend Micro Security Research - PUA.Win32.InstallerMonetizer",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pua.win32.installermonetizer"
    },
    {
      "name": "MITRE ATT&CK - Browser Extensions (T1176)",
      "url": "https://attack.mitre.org/techniques/T1176/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}