analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://ak.imgfarm.com/images/nocache/vicinio/installers/v2/222250168.TTAB02.1/nsis/907156-TTAB02.1/180816182826563/msniYourTemplateFinder/YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1.exe

Full analysis: https://app.any.run/tasks/05d87fd6-eb77-41e1-9b87-75663cb55598
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 22, 2019, 12:16:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
mindspark
Indicators:
MD5:

DF70EF32D8675522C2DF6CEA161634B6

SHA1:

55BEC491F113C20F37D1755B389F912F0A48497D

SHA256:

B3FB221A59313ED3E6087806A18643FE0CDFC205747854DA9128CA66AA056CC5

SSDEEP:

3:N1KfeEKCA0GEaAp3LWgOXBcXHQsdAnOuTIxBdVU0TBKrL0MjbLhbj0S8SrBEqoR9:C5TLpigOXBmQnOuTMBhBKsgDrE9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe (PID: 2464)

    • Loads dropped or rewritten executable

      • YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe (PID: 2464)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3152)

    • MINDSPARK was detected

      • YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe (PID: 2464)

  • SUSPICIOUS

    • Creates files in the user directory

      • YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe (PID: 2464)

    • Changes the started page of IE

      • YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe (PID: 2464)

    • Creates a software uninstall entry

      • YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe (PID: 2464)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2728)
      • YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe (PID: 2464)
      • iexplore.exe (PID: 3152)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2728)
      • iexplore.exe (PID: 3368)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3048)
      • iexplore.exe (PID: 3696)
      • iexplore.exe (PID: 3368)
      • iexplore.exe (PID: 3892)

    • Changes internet zones settings

      • iexplore.exe (PID: 2728)
      • iexplore.exe (PID: 3368)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3696)
      • iexplore.exe (PID: 3892)
      • iexplore.exe (PID: 2836)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3696)
      • iexplore.exe (PID: 3892)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3696)
      • iexplore.exe (PID: 3152)
      • iexplore.exe (PID: 2836)
      • iexplore.exe (PID: 3892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe #MINDSPARK yourtemplatefinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2728"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3152"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2728 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2464"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
iexplore.exe
User:
admin
Company:
Mindspark Interactive Network, Inc.
Integrity Level:
MEDIUM
Description:
YourTemplateFinder Setup
Exit code:
0
Version:
2.7.1.3000
3368"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3696"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3048C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
3892"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:203009C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2836"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3368 CREDAT:203010C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
1 644
Read events
1 422
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
11
Text files
80
Unknown types
6

Dropped files

PID
Process
Filename
Type
2728iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2728iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2728iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF5CD14E501C4C9215.TMP —
MD5:—
SHA256:—
2728iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFAE5A4E9511D0FECD.TMP —
MD5:—
SHA256:—
2728iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{9C56B2B5-1E3F-11E9-BAD8-5254004A04AF}.dat —
MD5:—
SHA256:—
3368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\favicon[1].ico —
MD5:—
SHA256:—
3368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2464YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exeC:\Users\admin\AppData\Local\Temp\nsb9A24.tmp\YourTemplateFinder_msi_bg-copy_1501857885092.bmpimage
MD5:6B58A0A87B7ADE1F6533F201D7C10450
SHA256:13D86CD66076216AF388C756E06504F3719C1B2C4A958C77CD4D5691A4532FA6
3152iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exeexecutable
MD5:60F93BA3820D72789A905921635CD9F7
SHA256:185A14F3280BBF973860D9946F7C87189A135B5F1B9D3281FC7E93D3213F8027
2464YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\installerParams[1].jhtmltext
MD5:7527FE195EB2905E27A1DB9C07582E6E
SHA256:B4A3FA20353A36736C2888A4C81CCA96748D500CF1AB5936B3F5CD11E09194A7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
71
TCP/UDP connections
36
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
GET
204
74.113.233.192:80
http://anx.mindspark.com/anx.gif?anxa=CAPDownloadProcess&anxe=InstallerFinished&tbUID=4FE2C851-5BA7-4C3C-A924-923D5360507F&tbVer=&platform=vicinio&anxv=2.7.1.3000&anxd=2018-08-16&coid=a7bf03dd02ba41d5b136dad9525b94c1&refPartner=^BNF^mni000^TTAB02&refSub=&anxl=en-US&anxr=2019078647&refCobrand=BNF&refCampaign=mni000&refTrack=TTAB02&refCountry=
US
—
—
whitelisted
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
GET
204
74.113.233.192:80
http://anx.mindspark.com/anx.gif?anxa=CAPDownloadProcess&anxe=Error&errorCode=-13&errorType=nsisError&errorDetails=EmptyPartnerId&platform=vicinio&anxv=2.7.1.3000&anxd=2018-08-16&coid=a7bf03dd02ba41d5b136dad9525b94c1&refPartner=^BNF^mni000^TTAB02&refSub=&anxl=en-US&anxr=2003527284&refCobrand=BNF&refCampaign=mni000&refTrack=TTAB02&refCountry=
US
—
—
whitelisted
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
GET
204
74.113.233.192:80
http://anx.mindspark.com/anx.gif?anxa=CAPDownloadProcess&anxe=InstallerInvoked&platform=vicinio&anxv=2.7.1.3000&anxd=2018-08-16&coid=a7bf03dd02ba41d5b136dad9525b94c1&refPartner=^BNF^mni000^TTAB02&refSub=&anxl=en-US&anxr=2138076824&refCobrand=BNF&refCampaign=mni000&refTrack=TTAB02&refCountry=
US
—
—
whitelisted
3368
iexplore.exe
GET
200
23.54.113.153:80
http://ak.staticimgfarm.com/images/vicinio/chrome/spent/images/favicon/BNF.ico
NL
image
1.12 Kb
whitelisted
3696
iexplore.exe
GET
200
23.54.113.153:80
http://hp.myway.com/yourtemplatefinder/ttab02/assets/1543611818812/app.js
NL
text
121 Kb
whitelisted
3696
iexplore.exe
GET
200
23.54.113.153:80
http://ak.staticimgfarm.com/images/webtooltab/assets/searchbar/223777673.png
NL
image
1.84 Kb
whitelisted
3696
iexplore.exe
GET
200
23.54.113.153:80
http://hp.myway.com/yourtemplatefinder/ttab02/index.html?n=7857AE74&p2=^BNF^mni000^TTAB02&ptb=4FE2C851-5BA7-4C3C-A924-923D5360507F&coid=a7bf03dd02ba41d5b136dad9525b94c1
NL
html
3.44 Kb
whitelisted
3696
iexplore.exe
GET
200
23.54.113.153:80
http://ak.staticimgfarm.com/images/webtooltab/ttdetect-2/prd/ttdetect.html
NL
html
4.49 Kb
whitelisted
3696
iexplore.exe
GET
200
23.54.113.153:80
http://hp.myway.com/yourtemplatefinder/ttab02/assets/1543611818812/ie8.js
NL
html
870 b
whitelisted
3152
iexplore.exe
GET
200
23.54.113.153:80
http://ak.imgfarm.com/images/nocache/vicinio/installers/v2/222250168.TTAB02.1/nsis/907156-TTAB02.1/180816182826563/msniYourTemplateFinder/YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1.exe
NL
executable
372 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2728
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3368
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
74.113.235.138:443
dp.tb.ask.com
Mindspark Interactive Network, Inc.
IE
malicious
3696
iexplore.exe
23.54.113.153:80
ak.imgfarm.com
Akamai International B.V.
NL
whitelisted
3368
iexplore.exe
23.54.113.153:80
ak.imgfarm.com
Akamai International B.V.
NL
whitelisted
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
74.113.233.192:80
anx.mindspark.com
Mindspark Interactive Network, Inc.
US
suspicious
3152
iexplore.exe
23.54.113.153:80
ak.imgfarm.com
Akamai International B.V.
NL
whitelisted
3696
iexplore.exe
74.113.233.187:80
anx.tb.ask.com
Mindspark Interactive Network, Inc.
US
unknown
3696
iexplore.exe
74.113.233.38:80
weatherblink.wdgserv.com
Mindspark Interactive Network, Inc.
US
unknown
3696
iexplore.exe
104.121.186.184:443
imp.admarketplace.net
Akamai Technologies, Inc.
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ak.imgfarm.com
  • 23.54.113.153
whitelisted
dp.tb.ask.com
  • 74.113.235.138
whitelisted
anx.mindspark.com
  • 74.113.233.192
whitelisted
hp.myway.com
  • 23.54.113.153
whitelisted
ak.staticimgfarm.com
  • 23.54.113.153
whitelisted
imp.admarketplace.net
  • 104.121.186.184
unknown
anx.tb.ask.com
  • 74.113.233.187
whitelisted
weatherblink.wdgserv.com
  • 74.113.233.38
unknown
lss.sse-iacapps.com
  • 199.36.102.124
whitelisted

Threats

PID
Process
Class
Message
3152
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark CAPDownloadProcess
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark User-Agent
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark CAPDownloadProcess
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark User-Agent
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark CAPDownloadProcess
2464
YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1[1].exe
Misc activity
ADWARE [PTsecurity] Mindspark User-Agent
3892
iexplore.exe
Web Application Attack
SC WEB_APPLICATION_ATTACK Microsoft Edge Chakra JIT BackwardPass::RemoveEmptyLoopAfterMemOp - Remote Code Execution posible
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://ak.imgfarm.com/images/nocache/vicinio/installers/v2/222250168.TTAB02.1/nsis/907156-TTAB02.1/180816182826563/msniYourTemplateFinder/YourTemplateFinder.a7bf03dd02ba41d5b136dad9525b94c1.exe