{
  "family": "primarypass",
  "sample_count": 30,
  "category": "adware",
  "description": "Primarypass (cataloged across security intelligence repositories under signatures including Adware:Win32/Primarypass, PUA:Win32/Primarypass, and BrowserModifier:Win32/Primarypass) is an intrusive adware framework and potentially unwanted application (PUA) active since 2015. Distributed primarily through deceptive third-party software bundlers, free utility repackagers, and torrent download wrappers, Primarypass is engineered to monetize infected Windows endpoints via forced advertising and search redirection. Upon execution, Primarypass injects unauthorized browser extensions into Google Chrome, Mozilla Firefox, and Microsoft Edge, modifying browser shortcut arguments and manipulating Group Policy Object (GPO) registry settings (such as ExtensionInstallForcelist) to prevent extension removal. It aggressively injects interstitial banner advertisements into visited websites, hijacks default search queries to affiliated advertising engines, and transmits user web browsing telemetry and search history to remote monetization servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Primarypass",
    "PUA:Win32/Primarypass",
    "BrowserModifier:Win32/Primarypass",
    "Win32/Primarypass",
    "Adware.Primarypass"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Primarypass?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Primarypass is an invasive adware and browser modifier that installs rogue browser extensions to inject ads and hijack search results."
      }
    },
    {
      "@type": "Question",
      "name": "How does Primarypass prevent users from removing its extensions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows Group Policy settings such as ExtensionInstallForcelist, making extension removal controls disabled in browser settings."
      }
    },
    {
      "@type": "Question",
      "name": "How is Primarypass distributed to Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled inside third-party software installers and freeware download wrappers using deceptive pre-checked opt-in boxes."
      }
    },
    {
      "@type": "Question",
      "name": "What data does Primarypass collect from infected systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It captures browsing history, search engine queries, clicked advertising links, and basic host hardware configurations."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove Primarypass from an endpoint?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clear rogue Group Policy entries in the registry, reset web browsers to default configurations, and run a full scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1112",
    "T1562.001",
    "T1189",
    "T1176",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Freeware Download Managers",
    "Torrent File Repackagers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Forced Browser Extension Installation (GPO)",
    "Web Traffic & Search Engine Query Hijacking",
    "In-Page Banner & Pop-Under Ad Injection",
    "User Browsing Telemetry Tracking",
    "Browser Shortcut Argument Modification"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Bundler Wrapper)",
      "Browser Extension Module (JSON / JS)"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET requests redirecting search traffic through affiliate tracking intermediate domains",
      "Encrypted telemetry POST beacons transmitting user search terms and visited domains"
    ],
    "evasion_techniques": [
      "Abusing Windows Group Policy ExtensionInstallForcelist keys to prevent browser extension deletion",
      "Modifying browser desktop shortcut .lnk files to append malicious tracking URLs"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "f3a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9",
      "04b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0"
    ],
    "registry_keys": [
      "HKLM\\SOFTWARE\\Policies\\Google\\Chrome\\ExtensionInstallForcelist",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PrimarypassUpdater"
    ],
    "file_paths": [
      "%ProgramFiles%\\Primarypass\\primarypass.exe",
      "%AppData%\\Primarypass\\config.json",
      "%LocalAppdata%\\Temp\\ad_wrapper.tmp"
    ]
  },
  "defensive_measures": [
    "Enforce administrative restrictions blocking user modifications to browser Group Policy registries",
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Audit desktop .lnk shortcut files for unauthorized appended URL parameters"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Primarypass",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Primarypass"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Primarypass",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Primarypass.A",
      "PUA:Win32/Primarypass.gen"
    ]
  },
  "motivation": "Advertising Monetization, Search Hijacking & Telemetry Harvesting",
  "sample_hashes": []
}