{
  "family": "purityscan",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Purityscan is an older, highly aggressive adware and spyware family that paved the way for modern Potentially Unwanted Programs (PUPs). Masquerading as a 'pornography blocker' or 'image scanner' (hence 'Purity'), its actual function is to aggressively hijack the user's browser, serve a massive volume of intrusive pop-up advertisements, and track browsing habits for affiliate revenue (`T1189`).<br><br><b>Understanding Purityscan (Aggressive Adware)</b><br>To an end-user, Purityscan was notorious for rendering a computer almost unusable due to the sheer volume of pop-up ads it generated. For IT security, it represents the deceptive nature of early adware, tricking users into installing a 'security' tool that is actually the malware itself.<br><br><b>Execution and Hijacking Mechanics</b><br>Purityscan was heavily distributed via deceptive advertising, bundled software, and sometimes ActiveX drive-by downloads. Upon execution, it entrenched itself deeply into the operating system. It established persistence by modifying Registry Run keys and creating Scheduled Tasks (`T1547.001`). Crucially, it injected its DLLs into the `explorer.exe` and `iexplore.exe` processes (`T1055`), allowing it to monitor all web traffic, intercept search queries, and force the browser to open new windows displaying advertisements from its affiliate networks.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is severe system degradation, loss of privacy, and an unusable web browsing experience. Host-based IoCs include the presence of the `purityscan.exe` executable, unauthorized DLL injection into browser processes, and extensive modifications to Internet Explorer's registry settings (BHOs, Start Page). Network IoCs involve constant HTTP traffic to known adware affiliate networks, even when the user is not actively browsing.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Purityscan and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Purityscan is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Purityscan establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Purityscan typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Purityscan compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Purityscan should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Purityscan leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Purityscan frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Purityscan maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Purityscan often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1547.001",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Initial distribution via deceptive marketing and bundles)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Injecting DLLs into browsers to monitor traffic and serve ads)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys (Persistence mechanism)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use a robust anti-malware and Adware removal tool to identify and strip out the deeply entrenched registry keys and injected DLLs.",
    "Use the standard Windows removal tools to uninstall the primary application, though it often leaves remnants behind.",
    "Reset all web browsers to their factory defaults to eliminate hijacked settings and malicious Browser Helper Objects (BHOs).",
    "Ensure endpoint Application Control is enabled to prevent users from installing unvetted 'security' tools."
  ],
  "what_to_avoid": [
    "Do not trust the application's built-in uninstaller, as it frequently fails to remove the core adware components.",
    "Avoid clicking on pop-up ads promising to 'clean' or 'secure' your PC, as this is a common delivery vector for this type of threat."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}