{
  "family": "onesystemcare",
  "sample_count": 14,
  "category": "pua",
  "description": "OneSystemCare (classified across security vendors as PUA:Win32/OneSystemCare and Program:Win32/OneSystemCare) is a Potentially Unwanted Application and scareware PC optimizer. Marketed as a system performance accelerator and registry cleaner, OneSystemCare deliberately inflates harmless temporary files, ordinary browser caches, and benign Windows registry keys into severe security vulnerabilities and critical performance hazards. It displays persistent intrusive alert pop-ups urging users to buy a paid software license to fix the non-existent errors, installs background updater services, and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/OneSystemCare",
    "Program:Win32/OneSystemCare",
    "OneSystemCare Optimizer",
    "Rogue:Win32/OneSystemCare",
    "Win32/OneSystemCare"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/OneSystemCare?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "OneSystemCare is a Potentially Unwanted Application that reports exaggerated PC issues to frighten users into buying licenses."
      }
    },
    {
      "@type": "Question",
      "name": "Are the system issues reported by OneSystemCare real?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. The software flags benign registry keys, standard cookies, and temporary files as critical system hazards."
      }
    },
    {
      "@type": "Question",
      "name": "How does OneSystemCare get onto a computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with freeware downloads, fake driver updaters, and deceptive online software advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does OneSystemCare maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds entries to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates scheduled tasks to display nag screens."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove OneSystemCare?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application through Windows Apps & Features, delete remaining program folders, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1491",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the end-user NOT to pay the requested fee; the reported system errors and malware infections are fabricated to induce panic.",
    "Use the Windows Control Panel to uninstall the rogue application, but do not assume this fully cleans the system.",
    "Deploy a reputable enterprise anti-malware or adware removal tool (e.g., Malwarebytes, AdwCleaner) to locate and delete the hidden registry keys and scheduled tasks left behind by the uninstaller.",
    "Review browser configurations to ensure no rogue extensions or homepage hijackers were installed alongside the scareware."
  ],
  "what_to_avoid": [
    "Do not input any credit card or personal information into the software's payment portal.",
    "Avoid ignoring the incident; if the user installed this, they may have unknowingly installed more severe malware from the same bundled package."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/OneSystemCare",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/OneSystemCare"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.OneSystemCare Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-onesystemcare"
    },
    {
      "name": "MITRE ATT&CK - Defacement: Displaying Fake Security Alerts (T1491)",
      "url": "https://attack.mitre.org/techniques/T1491/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}