{
  "family": "skintrim",
  "sample_count": 33,
  "category": "adware",
  "description": "Skintrim (cataloged in endpoint protection databases and threat intelligence feeds under signatures including Adware:Win32/Skintrim, PUA:Win32/Skintrim, and Trojan.Win32.Skintrim) is an invasive adware and browser-modifying threat active since 2015. Typically masquerading as desktop customization themes, media skins, or video format transcoders, Skintrim infects endpoints via software bundlers and deceptive download portals. Once executed, Skintrim writes startup entries into the Windows registry and installs background monitoring components that hook web browsers. Skintrim injects unauthorized banner ads into visited websites, generates intrusive pop-under windows, alters browser default search providers, and monitors user web browsing activity to report analytics back to affiliate marketing syndicates.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Skintrim",
    "PUA:Win32/Skintrim",
    "Trojan.Win32.Skintrim",
    "Win32/Skintrim",
    "Adware.Skintrim",
    "Adware:Win32/Skintrim.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Skintrim?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Skintrim is an adware family that injects intrusive pop-up banners, alters browser search defaults, and monitors user browsing behavior."
      }
    },
    {
      "@type": "Question",
      "name": "How does Skintrim infect Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It masquerades as free desktop themes, skins, or media converter tools distributed through third-party software bundlers."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by Skintrim?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Skintrim alters default search engines to sponsored redirect portals and injects banner advertisements into visited web pages."
      }
    },
    {
      "@type": "Question",
      "name": "How does Skintrim ensure persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers background services and writes autostart entries under the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How do I remove Skintrim from my computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application through Windows Control Panel, reset browser settings to default, and run a full scan with Windows Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1547.001",
    "T1036.005",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Desktop Theme Installers",
    "Third-Party Software Bundlers",
    "Malvertising Redirects"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Ad Banner Injection",
    "Pop-Under Browser Window Generation",
    "Search Query Redirection",
    "Browsing Activity Telemetry",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET queries fetching remote ad banner scripts and click-tracking pixels",
      "HTTP POST beacons reporting host hardware identifiers, browser versions, and search terms"
    ],
    "evasion_techniques": [
      "Masquerading binary filenames as Windows media components or desktop customization tools",
      "Registering autostart entries under obscure CLSID keys to evade routine registry inspection"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8",
      "d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SkintrimService",
      "HKLM\\Software\\Skintrim"
    ],
    "file_paths": [
      "%ProgramFiles%\\Skintrim\\skintrim.exe",
      "%AppData%\\Skintrim\\skintrim.dll",
      "%Temp%\\skintrim_setup.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Restrict regular users from running unverified executable installers from %Temp% and %AppData%",
    "Deploy secure DNS resolvers to block traffic to known adware advertising servers"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Skintrim",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Skintrim"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Skintrim",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Skintrim.A",
      "PUA:Win32/Skintrim.B"
    ]
  },
  "motivation": "Affiliate Advertising Monetization & Traffic Hijacking",
  "sample_hashes": []
}