{
  "family": "vigram",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware/PUP:Win32/Vigram is a prevalent Potentially Unwanted Program (PUP) categorized as Adware. It is designed to monetize the user's web browsing activity without their explicit consent by forcefully injecting intrusive advertisements, pop-unders, and sponsored links directly into the webpages they visit. Vigram significantly degrades system performance and poses privacy risks by tracking browsing history.<br><br><b>Understanding Vigram (Adware)</b><br>To an end-user, Vigram is highly visible: web pages load slowly, words within articles are mysteriously hyperlinked to advertising sites, and unclosable pop-up ads appear constantly. For a security operations center (SOC), Vigram is an indicator of poor user hygiene and risky downloading behavior, serving as a potential gateway for more severe 'Drive-by Compromise' (`T1189`) attacks via malvertising.<br><br><b>Execution and Hijacking Mechanics</b><br>Vigram is typically distributed via deceptive software bundles (wrappers) on third-party freeware sites. Upon execution, it installs itself, often masquerading as a legitimate browser helper object (BHO) or extension (`T1176`). It intercepts HTTP/HTTPS traffic locally to inject its own ad scripts directly into the Document Object Model (DOM) of the webpage before the browser renders it. To ensure it remains active, Vigram establishes persistence via Scheduled Tasks (`T1053.005`) or Registry Run keys (`T1547.001`), frequently employing randomized file names to evade simple signature-based removal scripts.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a severe degradation of the user experience and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for anomalous Scheduled Tasks launching browser processes or unknown executables from the `%AppData%` directory. Network IoCs include a massive increase in DNS queries and HTTP connections to known adware affiliate networks, tracking domains, and click-fraud infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Vigram and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vigram is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vigram establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vigram typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Vigram compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Vigram should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Vigram leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vigram frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vigram maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vigram often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1189",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious add-ons to facilitate ad injection)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Modifying browser settings without consent)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Initial distribution via software bundles)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Utilize the Windows 'Programs and Features' Control Panel to uninstall Vigram and any related software installed concurrently.",
    "Meticulously review the Windows Task Scheduler; Vigram relies heavily on scheduled tasks to reinstall its browser extensions.",
    "Reset all web browsers (Chrome, Edge, Firefox) to their default settings to remove the injected extensions and reset homepages.",
    "Deploy an enterprise-grade PUP/Adware removal tool to locate and clean the randomized, hidden files and registry hooks."
  ],
  "what_to_avoid": [
    "Do not allow users to click on the advertisements generated by Vigram, as they frequently lead to tech support scams or malware.",
    "Avoid trying to manually clean the registry without a specialized tool, as adware often uses complex, randomized keys."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}