{
  "family": "jawego",
  "sample_count": 32,
  "category": "adware",
  "description": "Jawego (tracked across security vendor signatures as Adware:Win32/Jawego, PUA:Win32/Jawego, and Adware.Jawego) is an aggressive adware and browser-hijacking framework active since 2015. Typically masquerading as a media player helper, format converter, or utility assistant, Jawego infiltrates Windows endpoints via third-party software bundlers and deceptive download portals. Once installed, Jawego hooks major web browsers, modifies browser shortcut launch targets (.lnk), injects intrusive sponsored banners into visited websites, and redirects user search queries to commercial advertising networks to generate pay-per-click revenue.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Jawego",
    "PUA:Win32/Jawego",
    "Trojan.Win32.Jawego",
    "Win32/Jawego",
    "Adware.Jawego",
    "Adware:Win32/Jawego.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Jawego?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jawego is an adware program that modifies browser shortcuts, injects unwanted advertisements, and redirects search queries to affiliate portals."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jawego modify browser shortcuts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the Target path of desktop browser shortcuts (.lnk) to append redirect URLs, loading advertising portals whenever the browser starts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Jawego spread to Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled within free utility installers, fake media codecs, and software converters from third-party download mirrors."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Jawego categorized as a Potentially Unwanted Application?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it makes intrusive browser changes without explicit consent and tracks web browsing habits for ad targeting."
      }
    },
    {
      "@type": "Question",
      "name": "How can I remove Jawego and restore my browser shortcuts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the software from Windows Settings, manually delete and recreate affected browser shortcuts, and run a malware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1547.001",
    "T1036.005",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Third-Party Software Bundlers",
    "Malvertising Redirects"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Shortcut Target Modification",
    "In-Page Advertisement Banner Injection",
    "Search Query Redirection",
    "Browsing Habit Telemetry Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET queries fetching remote ad banner scripts and click-tracking pixels",
      "HTTP POST beacons reporting host hardware identifiers, browser versions, and search terms"
    ],
    "evasion_techniques": [
      "Appending command-line redirect arguments to desktop browser shortcuts to avoid modifying browser binaries",
      "Deploying persistent watchdog services to restore registry settings if cleared"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0",
      "c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JawegoService",
      "HKLM\\Software\\Jawego"
    ],
    "file_paths": [
      "%ProgramFiles%\\Jawego\\jawego.exe",
      "%AppData%\\Jawego\\jawego.dll",
      "%Temp%\\jawego_setup.exe"
    ]
  },
  "defensive_measures": [
    "Audit browser shortcut files (.lnk) on endpoints for appended command-line URL redirect parameters",
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Defender",
    "Block known adware traffic redirection endpoints at enterprise DNS resolvers"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Jawego",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Jawego"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Jawego",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Jawego.A",
      "PUA:Win32/Jawego.B"
    ]
  },
  "motivation": "Affiliate Advertising Monetization & Traffic Redirection",
  "sample_hashes": []
}