{
  "family": "powp",
  "sample_count": 99,
  "category": "adware",
  "description": "Powp (identified across antimalware engines as Adware:Win32/Powp, Trojan:Win32/Powp, and PUA:Win32/Powp) is an aggressive adware monetization framework and software bundler active across Windows environments since 2014. Distributed primarily through Pay-Per-Install (PPI) wrapper networks, Powp infiltrates systems alongside third-party freeware installers, cracked utilities, and media player setup packages. Once launched, Powp silently extracts secondary advertising components and browser extension modules into %ProgramFiles% and %AppData% directories. It secures persistence by creating hidden Windows Scheduled Tasks and adding registry run entries in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. The adware intercepts web traffic across Google Chrome, Mozilla Firefox, and Microsoft Edge, altering browser default search engines to affiliate advertising portals, generating unwanted pop-under advertisements, and injecting commercial hyperlinks into visited webpages to generate illicit advertising revenue for its operators.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Powp",
    "Trojan:Win32/Powp",
    "PUA:Win32/Powp",
    "Win32/Powp"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Powp?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Powp is an adware and potentially unwanted application framework that injects advertisements and hijacks browser search traffic."
      }
    },
    {
      "@type": "Question",
      "name": "How does Powp enter user computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled into freeware download packages, software cracks, and deceptive installation wizards using dark patterns."
      }
    },
    {
      "@type": "Question",
      "name": "What modifications does Powp make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs rogue extensions, alters default search providers to affiliated portals, and injects commercial hyperlinks into websites."
      }
    },
    {
      "@type": "Question",
      "name": "Does Powp create persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it creates autostart registry entries under CurrentVersion\\Run and registers background scheduled tasks to reinstall modules."
      }
    },
    {
      "@type": "Question",
      "name": "How can Powp be completely uninstalled?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy an adware scanner like Malwarebytes, reset web browsers to default configurations, and remove persistent scheduled tasks."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1562.001",
    "T1176",
    "T1112",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Quarantine the initial freeware bundler or dropper executable to prevent secondary adware installation routines.",
    "Deploy specialized adware removal tools (such as Malwarebytes AdwCleaner) to locate and strip rogue services and registry hooks.",
    "Reset all installed web browsers to default factory configurations to eradicate injected extensions and restore legitimate search engines.",
    "Audit the Windows Task Scheduler for persistent background tasks configured to launch unsigned scripts from %AppData%."
  ],
  "what_to_avoid": [
    "Do not rely solely on default application uninstallers, as adware bundlers often leave persistence watchdog tasks behind.",
    "Avoid clicking on deceptive search redirect warnings or sponsored banner ads injected by the adware."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Commercial Workstations"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "PPI Monetization Affiliates"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "lineage": {
    "derived_from": [
      "Deceptive PPI Software Bundlers"
    ],
    "variants": [
      "Powp.A",
      "Powp.gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f",
      "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a"
    ],
    "delivery": [
      "Pay-Per-Install software bundlers and repackaged freeware downloads",
      "Deceptive advertising redirects and fake utility installers"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PowpService",
      "Scheduled Task launching dropped extension scripts from %AppData%"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Adware:Win32/Powp",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Powp"
    },
    {
      "name": "EnigmaSoft Threat Database - Adware.Powp Overview",
      "url": "https://www.enigmasoftware.com/adwarepowp-removal/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}