{
  "family": "oneinstaller",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Oneinstaller is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler'. Its primary function is to act as an installation wrapper for other software. While it may install a legitimate freeware application the user requested, it deceptively packages and installs multiple other unwanted applications—such as browser hijackers, fake system optimizers, and aggressive adware—to generate pay-per-install revenue for the developers.<br><br><b>Understanding Oneinstaller (Software Bundling)</b><br>To an end-user, executing Oneinstaller looks like a normal software setup wizard. However, if the user rapidly clicks 'Next' without reading the fine print (a 'dark pattern' UI design), their machine is flooded with unwanted software. For a security administrator, Oneinstaller represents a significant risk to endpoint hygiene and a common vector for introducing vulnerabilities (`T1189`).<br><br><b>Execution and Deception Mechanics</b><br>Oneinstaller is primarily distributed via third-party software download portals (like CNET or Softonic) or through deceptive advertisements offering 'free' utilities. Upon execution (`T1204.002`), the wrapper requests Administrator privileges. It then downloads and silently installs (`T1105`) the bundled payloads in the background while displaying the installation progress for the primary application. These secondary payloads establish persistence (`T1547.001`), modify browser settings (`T1562.001`), and begin displaying intrusive advertisements.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded user experience, system slowdowns, and increased attack surface due to the installation of unverified software. Host-based IoCs include the sudden appearance of multiple unknown applications in the Windows 'Programs and Features' list, new browser extensions, and modified homepage settings. Network IoCs include EDR alerts for a single installer process spawning multiple child processes or making numerous outbound connections to diverse software distribution domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Oneinstaller and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Oneinstaller is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Oneinstaller establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Oneinstaller typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Oneinstaller compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Oneinstaller should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Oneinstaller leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Oneinstaller frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Oneinstaller maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Oneinstaller often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1105",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Deceptive software bundling portals)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the secondary bundled payloads)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Browser hijacking by the payloads)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to manually uninstall all applications introduced by the bundler (check the 'Installed On' date to group them).",
    "Reset all web browsers (Chrome, Edge, Firefox) to their default settings to clear out any hijacked homepages or malicious extensions.",
    "Run a full system scan with a reputable Adware/PUP removal tool to clean up the registry persistence mechanisms left behind by the bundled payloads.",
    "Implement Application Control (WDAC/AppLocker) or strict standard-user privileges to prevent users from executing unapproved installers."
  ],
  "what_to_avoid": [
    "Do not allow users to download software from unverified third-party portals; always use the official vendor websites.",
    "Avoid assuming that uninstalling the 'primary' application also removes the bundled adware; they must all be uninstalled separately."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}