{
  "family": "wronginf",
  "sample_count": 99,
  "category": "rogue_antivirus",
  "description": "Wronginf (cataloged under Microsoft Defender and vendor signatures as Rogue:Win32/Wronginf, Trojan:Win32/Wronginf, and Win32:WrongInf) is an aggressive scareware and rogue security application family active since 2011. Wronginf specializes in manipulating Windows setup configuration scripts (.INF files) and system installer routines to bypass standard security alerts and execute silently. Distributed primarily through deceptive advertising networks, fake online virus scanning portals, and bundled freeware wrappers, Wronginf immediately presents the victim with full-screen, unclosable alert banners claiming the workstation is critically infected with hundreds of nonexistent viruses and trojans. To prevent remediation, Wronginf alters system registry policies to disable essential administrative tools—terminating Windows Task Manager (DisableTaskMgr), the Registry Editor (DisableRegistryTools), and Command Prompt. It blocks access to web browsers and legitimate security software while displaying high-pressure countdown timers coercing the victim into purchasing a fraudulent license key.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Rogue:Win32/Wronginf",
    "Trojan:Win32/Wronginf",
    "Win32:WrongInf",
    "Rogue.Wronginf"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Rogue:Win32/Wronginf threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wronginf is a scareware rogue security program that generates fabricated infection alerts to extort payments for fake software licenses."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wronginf manipulate Windows setup files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies or weaponizes Windows .INF setup configuration scripts to execute installation actions while evading detection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wronginf prevent users from closing its fake alerts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies registry policies to disable Task Manager (DisableTaskMgr) and Registry Editor and kills administrative utilities."
      }
    },
    {
      "@type": "Question",
      "name": "What should victims do if they entered credit card information?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately contact their credit card issuer to dispute fraudulent transactions, cancel the compromised card, and monitor statements."
      }
    },
    {
      "@type": "Question",
      "name": "How can Wronginf be eradicated from an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Windows Safe Mode, run an offline antimalware scanner like Malwarebytes, and restore disabled administrative registry policies."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1491.001",
    "T1189",
    "T1562.001",
    "T1204.002",
    "T1547.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Reboot the infected machine into Windows Safe Mode to suppress the rogue autostart screen lock and alert routines.",
    "Run a full offline scan using specialized antimalware tools (e.g., Malwarebytes or Microsoft Defender Offline) to purge rogue executables.",
    "Restore administrative access by resetting the DisableTaskMgr and DisableRegistryTools registry policy keys to 0.",
    "Advise victims who entered credit card details to contact their banking provider immediately to cancel compromised cards."
  ],
  "what_to_avoid": [
    "Do not enter credit card or payment details into the fake software, as the alerts are completely fabricated.",
    "Avoid assuming the system is secure once alerts stop, as scareware droppers frequently leave secondary backdoors in place."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Commercial Workstations"
  ],
  "motivation": "Fraudulent Extortion",
  "threat_actors": [
    "Scareware Syndicates",
    "Rogue Antivirus Affiliates"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "lineage": {
    "derived_from": [
      "Classic Windows Scareware Families"
    ],
    "variants": [
      "Wronginf.A",
      "Win32.WrongInf.gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d",
      "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e"
    ],
    "delivery": [
      "Drive-by downloads from malvertising and fake online virus scanner sites",
      "Weaponized .INF setup scripts bundled inside cracked software"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Wronginf",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Rogue:Win32/Wronginf",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rogue:Win32/Wronginf"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Rogue_Wronginf",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/rogue_wronginf"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}