{
  "family": "openinstall",
  "sample_count": 14,
  "category": "adware",
  "description": "OpenInstall (classified across security vendors as Adware:Win32/OpenInstall and PUA:Win32/OpenInstall) is an aggressive software bundler and adware delivery platform. Distributed via misleading online download portals and cracked software repositories, OpenInstall wraps legitimate software installers with multiple unwanted payloads, including browser hijackers, system trackers, and background ad injection modules. It secretly changes default search engines and new tab pages across installed web browsers, establishes persistence through Windows scheduled tasks and Run registry entries, and intercepts user browsing traffic to display affiliate banners and redirect URLs.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/OpenInstall",
    "PUA:Win32/OpenInstall",
    "OpenInstall Bundler",
    "Program:Win32/OpenInstall",
    "Win32/OpenInstall"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/OpenInstall?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "OpenInstall is a software bundler that packages third-party freeware to inject adware and browser modifiers without clear consent."
      }
    },
    {
      "@type": "Question",
      "name": "How does OpenInstall distribute itself?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through deceptive freeware download hubs, torrent sites, and fake software update dialogs."
      }
    },
    {
      "@type": "Question",
      "name": "What unwanted changes does OpenInstall make to browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser homepages, forces new default search engines, and injects sponsored commercial ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does OpenInstall survive computer restarts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows Run registry keys and schedules daily background tasks for automated execution."
      }
    },
    {
      "@type": "Question",
      "name": "How can users remove OpenInstall and bundled adware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall bundled programs in Windows Settings, reset browser default configurations, and run an updated antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.004",
      "name": "Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch)",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to systematically identify and uninstall all recently added programs, focusing on toolbars and 'search protectors'.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to strip the deeply embedded Scheduled Tasks and registry hooks left behind by the Openinstall framework.",
    "Force a complete reset of all installed web browsers (Chrome, Edge, Firefox) to factory defaults to eradicate rogue extensions and restore the homepage.",
    "Quarantine the original installer file to prevent further execution."
  ],
  "what_to_avoid": [
    "Do not rely solely on manual uninstallation via the Control Panel; Openinstall payloads frequently use watchdog services to immediately reinstall themselves.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or provide a foothold for more severe malvertising attacks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/OpenInstall",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/OpenInstall"
    },
    {
      "name": "Trend Micro Security Research - PUA.Win32.OpenInstall Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pua.win32.openinstall"
    },
    {
      "name": "MITRE ATT&CK - Browser Extensions (T1176)",
      "url": "https://attack.mitre.org/techniques/T1176/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}