{
  "family": "qqware",
  "sample_count": 14,
  "category": "browser_modifier",
  "description": "QQWare (classified across antivirus vendors under BrowserModifier:Win32/QQWare and Adware:Win32/QQWare) is an intrusive adware and browser modification family targeting Windows systems. Typically bundled with Chinese freeware utilities, pirated software, and media players, QQWare forcefully modifies web browser shortcuts, homepages, and default search providers across Google Chrome, Mozilla Firefox, and Internet Explorer. It injects affiliate advertisements, banner pop-ups, and sponsored search links into browsing sessions, routes search queries through monetized portal domains, and installs background watchdog processes to re-apply modifications if removed by the user.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/QQWare",
    "Adware:Win32/QQWare",
    "PUA:Win32/QQWare",
    "QQWare Adware",
    "Win32/QQWare"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/QQWare?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "QQWare is a browser modifier and adware application that hijacks browser homepages and injects sponsored advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does QQWare tamper with web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser startup shortcuts, resets search engines to partner domains, and installs persistent adware extensions."
      }
    },
    {
      "@type": "Question",
      "name": "How does QQWare prevent users from restoring their settings?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It deploys background watchdog services that continuously monitor and re-apply malicious browser configurations."
      }
    },
    {
      "@type": "Question",
      "name": "What telemetry does QQWare collect from users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It logs user web searches, clicked URLs, IP addresses, and hardware configurations for ad targeting."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely eradicate QQWare?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remove unwanted browser extensions, fix desktop shortcuts, delete watchdog scheduled tasks, and run an antimalware scanner."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.009",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to uninstall the primary Qqware application and any associated 'search protectors' or toolbars.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to strip the remaining Scheduled Tasks and registry hooks left behind by the uninstaller.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop and Taskbar to remove any appended malicious URLs.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; the software uses watchdog services to immediately re-apply the malicious settings.",
    "Avoid ignoring the infection; the affiliate networks powering these hijackers often serve malicious advertisements that can lead to severe malware infections."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/QQWare",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/QQWare"
    },
    {
      "name": "Trend Micro Security Research - BrowserModifier.Win32.QQWare",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/browsermodifier.win32.qqware"
    },
    {
      "name": "MITRE ATT&CK - Shortcut Modification (T1547.009)",
      "url": "https://attack.mitre.org/techniques/T1547/009/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}