| URL: | ak.ocoaksib.com/4/6118780 |
| Full analysis: | https://app.any.run/tasks/b03e0a2d-8762-4389-96d4-b616cabbb3d7 |
| Verdict: | Malicious activity |
| Analysis date: | February 27, 2024, 15:40:41 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 5780AA829D401E654B16A662796B541F |
| SHA1: | 1D9A08B379859A9918F15051B5D24467031906D2 |
| SHA256: | 894A6B2E6C6C247A19CB2F04821E86251A41C817877BFCD38E1CDA6FFAD261A7 |
| SSDEEP: | 3:nUE5MH5:Uz5 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2032 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 532 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=692 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 584 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2956 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 952 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3424 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1040 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1516 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1368 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2596 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 1796 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1936 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3472 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2148 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1244 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| 2228 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2568 --field-trial-handle=1164,i,2532196339168984491,11293414647763908868,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 109.0.5414.120 Modules
| |||||||||||||||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (4052) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF180cdc.TMP | — | |
MD5:— | SHA256:— | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Variations | binary | |
MD5:961E3604F228B0D10541EBF921500C86 | SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\049cfcdd-f955-4a33-807a-657dd04e9a41.tmp | binary | |
MD5:5058F1AF8388633F609CADB75A75DC9D | SHA256:— | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF180eff.TMP | text | |
MD5:C5B082BC8EA6A9BD1DC6782C00A79605 | SHA256:6168A9E585264DE05DEE1B67427B1BC277F1B83B9297184EFACC5D3BB061ABDE | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old | text | |
MD5:4E2B7997F4C3647F8D1ADA88339BBBA5 | SHA256:C33226C460208AA10537A23CB5128FD887DCBAA335C7DC8BFFBE08A607CCFDF5 | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF181529.TMP | — | |
MD5:— | SHA256:— | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | text | |
MD5:4755704EAEB72509F8E78594142D80D6 | SHA256:52D45B3A4947B8B5B8C48F83F83BA6758CFB7C4434FC574124378F5B01E15999 | |||
| 4052 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old | text | |
MD5:AD0DB8476493577A67FA94A162B646C4 | SHA256:304FB5B4FD83D4A9FF1EF4CF20232A1783169C148297BFE37ED24A1D22A74F2B | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3460 | chrome.exe | GET | 200 | 193.108.153.15:80 | http://ak.ocoaksib.com/4/6118780 | unknown | html | 815 b | unknown |
3460 | chrome.exe | GET | 200 | 193.108.153.15:80 | http://ak.ocoaksib.com/partitial/5117854/?var=6118780&ab2r=150040&prfrev=false&rhd=false&sf=1 | unknown | html | 13.0 Kb | unknown |
3460 | chrome.exe | GET | 200 | 193.108.153.15:80 | http://ak.ocoaksib.com/ | unknown | text | 8 b | unknown |
3460 | chrome.exe | GET | 204 | 193.108.153.15:80 | http://ak.ocoaksib.com/favicon.ico | unknown | text | 8 b | unknown |
3460 | chrome.exe | POST | 200 | 193.108.153.15:80 | http://ak.ocoaksib.com/sftouch?userId=00800fe3aad24a18f13dee0f4d7431b5&z=5117854&p_rid=171d295c-5126-4c10-9f51-bc89619d4484&p_src=sf&branchId=150040&rb=ldWjUFM_xbSe1VI4H890rXCCvEo7oMdjLOPqfNPsmueUc_fnhua1CXqbSWx4M-2fC8I-94sQRAs9OwCba4YsICXihQHU9NGy3BNwE-FqLFofqoxe_iUiKtdB183abRHwRzG-iJvgMk28G3YFF3poAaZRfW1AU5qAE86s0qNZ9XZcId6QkDNUxpCbvU1sNpva7CryZvNAfrco5hfHwzzrF_7N1HwgrWS2wY6mmY2Q9id_d6tIeNg7MbrnXUtR6E6ZmYuP5VGiickln0Sc_kXCjOSdPAmvKRbEMhxB8KraGPDC1bJx | unknown | text | 2 b | unknown |
3460 | chrome.exe | GET | 204 | 193.108.153.15:80 | http://ak.ocoaksib.com/favicon.ico | unknown | text | 2 b | unknown |
3460 | chrome.exe | GET | — | 193.108.153.15:80 | http://ak.ocoaksib.com/favicon.ico | unknown | — | — | unknown |
3460 | chrome.exe | GET | 204 | 193.108.153.15:80 | http://ak.ocoaksib.com/favicon.ico | unknown | — | — | unknown |
3460 | chrome.exe | POST | 302 | 193.108.153.15:80 | http://ak.ocoaksib.com/?z=5117854&syncedCookie=true&rhd=false | unknown | text | 2 b | unknown |
856 | svchost.exe | HEAD | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01uSGNvRHZ2Tm5HQQ/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3460 | chrome.exe | 193.108.153.15:80 | ak.ocoaksib.com | Akamai International B.V. | DE | unknown |
4052 | chrome.exe | 239.255.255.250:1900 | — | — | — | unknown |
3460 | chrome.exe | 108.177.15.84:443 | accounts.google.com | GOOGLE | US | unknown |
3460 | chrome.exe | 139.45.195.8:443 | my.rtmark.net | RETN Limited | GB | unknown |
3460 | chrome.exe | 139.45.197.240:443 | propeller-tracking.com | RETN Limited | GB | unknown |
3460 | chrome.exe | 3.70.16.242:443 | v2e81.bemobtrcks.com | AMAZON-02 | DE | unknown |
3460 | chrome.exe | 212.117.190.201:443 | sr7pv7n5x.com | — | LU | unknown |
Domain | IP | Reputation |
|---|---|---|
ak.ocoaksib.com |
| unknown |
accounts.google.com |
| shared |
propeller-tracking.com |
| whitelisted |
my.rtmark.net |
| whitelisted |
v2e81.bemobtrcks.com |
| unknown |
sr7pv7n5x.com |
| malicious |
thanks-page.com |
| unknown |
lbpx.thanks-page.com |
| unknown |
www.google.com |
| whitelisted |
chromewebstore.google.com |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
3460 | chrome.exe | Possibly Unwanted Program Detected | ET ADWARE_PUP Win32/Adware.Agent.NSU CnC Activity M2 |
3460 | chrome.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |
3460 | chrome.exe | Misc activity | ET INFO Observed ZeroSSL SSL/TLS Certificate |
3460 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net) |
3460 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net) |
3460 | chrome.exe | Not Suspicious Traffic | INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net) |
3460 | chrome.exe | Possibly Unwanted Program Detected | ET ADWARE_PUP Win32/Adware.Agent.NSU CnC Activity M2 |