Lion Cipher Lab

Characterize adware: bundled installers, pop-up processes, and ad-network traffic

• Digital Forensics & IR (DFIR)
• Beginner
• ~40 min
• Free · no account required

Why it matters

Adware is the most common 'my computer is acting weird' ticket a help desk or junior analyst ever sees: endless pop-ups, a hijacked browser, a machine that got slow overnight. It is easy to dismiss as harmless nuisance-ware — and that dismissal is exactly the mistake. Adware and PUPs (potentially unwanted programs) install through deceptive bundling, plant MULTIPLE persistence anchors so they survive a half-hearted cleanup, and — critically — many of them can pull DOWN further payloads, which is the moment a nuisance becomes a real infection. Learning to read the artifacts an adware infection…

What you'll learn

• reading a bundled-installer footprint to spot a PUP (potentially unwanted program) that rode in alongside a wanted app
• recognising spawned pop-up / ad processes and telling them apart from legitimate background software
• reading the persistence pair — a Scheduled Task AND a Run key — and understanding why the pop-ups respawn after you kill them
• reading browser modifications (new-tab / search / injected ad scripts) and connecting them to a browser-hijacker footprint
• reading ad-network / affiliate / click-fraud network destinations and recognising automated ad-click beaconing
• mapping observed behaviour to MITRE ATT&CK T1053.005 (Scheduled Task), T1547.001 (Registry Run Keys), and T1071 (Application Layer Protocol)
• judgment: deciding WHEN the artifacts say 'nuisance adware' vs a more serious infection — does it only serve ads, or does it also download further payloads?
• building a complete removal checklist: every persistence anchor plus every bundled component, so nothing respawns

Steps in this lab

1. The scene: one 'free PDF converter,' a slow laptop, and five bundles of artifacts
2. Bundle 1 — the bundled-installer footprint: the PUP that rode in with the converter
3. Bundle 2 — the running processes: the pop-up and ad-refresh engine
4. Bundle 3 — the persistence pair: a Scheduled Task AND a Run key (T1053.005 + T1547.001)
5. Bundle 4 — the browser modifications: the hijacker footprint inside the adware
6. Bundle 5 — the network log: ad-network, affiliate, and click-fraud traffic (T1071)
7. WHEN this is nuisance adware — and WHEN the same artifacts say 'real infection'
8. Map it, then remove every anchor and every bundled component — or it comes back

Open the full interactive lab →