{
  "family": "uniblue",
  "sample_count": 74,
  "category": "pua",
  "description": "Uniblue (cataloged across security vendors and antimalware engines under detections including PUA:Win32/Uniblue, Program:Win32/Uniblue, and PUP.Optional.Uniblue) represents a family of Potentially Unwanted Applications and system optimizer software suites produced by Uniblue Systems, including RegistryBooster, SpeedUpMyPC, and DriverScanner. While marketed as commercial Windows maintenance tools, these programs employ deceptive marketing practices, exaggerated diagnostic scan results, and aggressive scareware prompts designed to convince users that harmless or normal registry entries constitute critical system errors requiring paid software licenses. Uniblue applications frequently install via bundled freeware wrappers, configure persistent autostart services under Windows CurrentVersion\\Run, and trigger recurring pop-up alerts. Antivirus vendors classify Uniblue utilities as Potentially Unwanted Applications due to their misleading notifications, invasive bundling distribution mechanisms, and negligible performance benefits.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/Uniblue",
    "Program:Win32/Uniblue",
    "PUP.Optional.Uniblue",
    "RegistryBooster"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/Uniblue?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uniblue is a family of potentially unwanted system optimization and registry cleaner applications."
      }
    },
    {
      "@type": "Question",
      "name": "Why do antivirus vendors detect Uniblue RegistryBooster as a PUA?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It exaggerates normal registry entries as severe system problems to frighten users into buying commercial software licenses."
      }
    },
    {
      "@type": "Question",
      "name": "How does Uniblue software typically install on computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is predominantly distributed through third-party freeware downloaders and bundled software setup packages."
      }
    },
    {
      "@type": "Question",
      "name": "What persistent changes are made by Uniblue programs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They create startup registry keys under CurrentVersion\\Run and schedule background maintenance tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Uniblue applications?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the software through Windows Settings Apps, delete residual registry keys, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1547.001",
    "T1059.003",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint temporarily to prevent further intrusive pop-ups and unnecessary telemetry collection.",
    "Audit the 'Add/Remove Programs' list and manually uninstall the Uniblue application and any associated bundled software.",
    "Review the Windows Task Scheduler and delete any remaining tasks designed to launch the Uniblue updater or scanner.",
    "Educate the user on the deceptive tactics used by 'registry cleaners' and the risks of downloading bundled freeware."
  ],
  "what_to_avoid": [
    "Do not allow users to purchase or enter credit card information into the application; it reinforces the scareware business model.",
    "Avoid relying solely on the application's built-in uninstaller, as it frequently leaves behind persistent registry keys or scheduled tasks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Commercial Software Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Bundlers",
    "Sponsored Search Advertising",
    "Affiliate Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Exaggerated System Diagnostics",
    "Deceptive Registry Error Warnings",
    "Persistent Background Task Scheduling",
    "Commercial Payment Gateway Redirection",
    "Automatic Startup Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)",
      "Windows Installer (.msi)"
    ],
    "network_signatures": [
      "HTTP requests to Uniblue licensing and telemetry servers",
      "Affiliate tracking URL redirects"
    ],
    "evasion_techniques": [
      "Valid Authenticode digital signatures from Uniblue Systems Limited",
      "Legitimate-looking GUI styling to mimic operating system utilities"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RegistryBooster",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SpeedUpMyPC"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Low",
    "availability": "Low",
    "scope": "Misleading alerts, aggressive purchase prompts, unnecessary registry tampering"
  },
  "lineage": {
    "derived_from": [
      "Commercial Registry Cleaner Architectures"
    ],
    "variants": [
      "RegistryBooster",
      "SpeedUpMyPC",
      "DriverScanner"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b",
      "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c"
    ],
    "delivery": [
      "registrybooster_setup.exe",
      "speedupmypc_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RegistryBooster",
      "%ProgramFiles%\\Uniblue\\RegistryBooster\\rb.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - PUA:Win32/Uniblue",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Uniblue"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.Uniblue",
      "url": "https://www.trendmicro.com"
    }
  ]
}