{
  "family": "ulpm",
  "sample_count": 55,
  "category": "adware",
  "description": "Ulpm (tracked across antivirus telemetry as Adware:Win32/Ulpm, TR/Crypt.ULPM.Gen, and PUA:Win32/Ulpm) is a persistent adware and potentially unwanted application (PUA) family active since 2016. Distributed through deceptive software portals, game cracks, and keygens, Ulpm leverages packers to evade initial antivirus scanning. Once executed, it modifies browser shortcut arguments, injects unauthorized advertising links into web sessions, and tracks browsing activities to monetize user traffic through third-party affiliate advertising networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Ulpm",
    "TR/Crypt.ULPM.Gen",
    "PUA:Win32/Ulpm",
    "Adware.Win32.Ulpm",
    "Win32/Ulpm"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Ulpm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ulpm is an adware family that displays intrusive advertising banners and redirects web browser searches without user consent."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ulpm infect computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly infiltrates systems through bundled free software installers, cracked games, and unauthorized utilities."
      }
    },
    {
      "@type": "Question",
      "name": "What privacy risks are associated with Ulpm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors user browsing habits and search queries to deliver targeted promotional advertisements and monetization links."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ulpm manipulate web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser startup arguments and desktop shortcuts to force traffic through affiliate search engines."
      }
    },
    {
      "@type": "Question",
      "name": "How can Ulpm be removed completely?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Offline scan, clean browser shortcuts, and remove unknown browser extensions."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Download Wrappers",
    "Software Cracks & Keygens",
    "Affiliate Advertising Networks"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Shortcut Parameter Hijacking",
    "Pop-Up & In-Page Ad Injection",
    "Web Browsing Telemetry Collection",
    "Registry Run Key Persistence",
    "Commercial Cryptor / Packer Wrapping"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Obfuscated Cryptor Wrapper"
    ],
    "network_signatures": [
      "HTTP GET beacons querying affiliate advertising servers for promotional URLs",
      "DNS requests resolving dynamic traffic redirect domains"
    ],
    "evasion_techniques": [
      "Wrapping executable payload in proprietary cryptors (TR/Crypt.ULPM.Gen)",
      "Modifying browser shortcuts rather than editing browser core binary files"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9271649275819385920a19e48b3b42f2b3e449a5",
      "781bb49f8b15df726489312bcf8194ad92716492"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UlpmService"
    ],
    "file_paths": [
      "%AppData%\\Ulpm\\ulpm.exe",
      "%Temp%\\ulpm_install.log"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Audit and restore modified browser desktop shortcuts",
    "Deploy network filtering to block known adware syndication and click-fraud domains"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Ulpm",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Ulpm"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TR/Crypt.ULPM.Gen",
      "PUA:Win32/Ulpm.A"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Click Adware Monetization",
  "sample_hashes": []
}