{
  "family": "elemental",
  "sample_count": 82,
  "category": "adware",
  "description": "Elemental (cataloged in antivirus telemetry under detections including PUP.Elemental, Trojan:Win32/Elemental, and Win32/Elemental) is an adware packaging framework and potentially unwanted application active since 2015. Bundled into freeware media players, document readers, and torrent utilities, Elemental is distributed through pay-per-install monetization networks. Once installed on a Windows workstation, Elemental establishes persistent background helper tasks and alters web browser configurations across Google Chrome, Mozilla Firefox, and Microsoft Edge. It forcibly modifies browser shortcut target paths, injects intrusive full-page pop-up advertisements and sponsored affiliate banners into visited websites, and redirects search queries to partner advertising syndicates. Elemental also collects host system identifiers, browsing queries, and IP location data to optimize commercial ad-targeting campaigns.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUP.Elemental",
    "Trojan:Win32/Elemental",
    "Win32/Elemental"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUP.Elemental?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Elemental is an adware program and potentially unwanted application (PUP) that injects ads and hijacks browser settings."
      }
    },
    {
      "@type": "Question",
      "name": "How does Elemental get onto Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled inside free software downloads, media players, and deceptive installation wrappers."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does Elemental make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It alters desktop shortcuts, injects aggressive banner advertisements, and redirects web searches to ad portals."
      }
    },
    {
      "@type": "Question",
      "name": "Does Elemental collect user browsing data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it collects search queries, visited URLs, IP addresses, and system hardware specifications."
      }
    },
    {
      "@type": "Question",
      "name": "How can users eradicate Elemental from their PC?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall rogue freeware applications, restore browser shortcuts to default, and run a complete antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1189",
    "T1547.001",
    "T1176",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Elemental payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Elemental persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Software Bundlers",
    "Freeware Download Repositories",
    "Deceptive Installation Wrappers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Ad Injection",
    "Browser Shortcut Manipulation",
    "Search Engine Redirection",
    "Telemetry Harvesting",
    "Background Service Maintenance"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Browser Extension",
      "DLL"
    ],
    "network_signatures": [
      "HTTP search query redirects to ad monetization hubs",
      "Encrypted telemetry check-ins reporting browsing statistics"
    ],
    "evasion_techniques": [
      "Legitimate utility packaging masking adware stubs",
      "Silent command-line installation arguments"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Elemental",
      "Scheduled Task launching updater at logon"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Browser configuration integrity, search privacy, system performance"
  },
  "lineage": {
    "derived_from": [
      "Commercial Adware Bundlers"
    ],
    "variants": [
      "Elemental.A",
      "Elemental.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a",
      "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d"
    ],
    "delivery": [
      "media_suite_setup.exe",
      "elemental_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ElementalUpdate",
      "C:\\Program Files (x86)\\Elemental\\elemental_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "EnigmaSoft Threat Research - PUP.Elemental Analysis",
      "url": "https://www.enigmasoftware.com"
    },
    {
      "name": "Joe Sandbox Cloud - Elemental Behavioral Analysis Report",
      "url": "https://www.joesandbox.com"
    }
  ]
}