Running Chrome VPN Extensions via the Registry 2 VPN Extension

  1title: Running Chrome VPN Extensions via the Registry 2 VPN Extension
  2id: b64a026b-8deb-4c1d-92fd-98893209dff1
  3status: test
  4description: Running Chrome VPN Extensions via the Registry install 2 vpn extension
  5references:
  6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension
  7author: frack113
  8date: 2021-12-28
  9modified: 2023-08-17
 10tags:
 11    - attack.initial-access
 12    - attack.persistence
 13    - attack.t1133
 14logsource:
 15    category: registry_set
 16    product: windows
 17detection:
 18    chrome_ext:
 19        TargetObject|contains: 'Software\Wow6432Node\Google\Chrome\Extensions'
 20        TargetObject|endswith: 'update_url'
 21    chrome_vpn:
 22        TargetObject|contains:
 23            - fdcgdnkidjaadafnichfpabhfomcebme # ZenMate VPN
 24            - fcfhplploccackoneaefokcmbjfbkenj # 1clickVPN
 25            - bihmplhobchoageeokmgbdihknkjbknd # Touch VPN
 26            - gkojfkhlekighikafcpjkiklfbnlmeio # Hola Free VPN
 27            - jajilbjjinjmgcibalaakngmkilboobh # Astar VPN
 28            - gjknjjomckknofjidppipffbpoekiipm # VPN Free
 29            - nabbmpekekjknlbkgpodfndbodhijjem # Earth VPN
 30            - kpiecbcckbofpmkkkdibbllpinceiihk # DotVPN
 31            - nlbejmccbhkncgokjcmghpfloaajcffj # Hotspot Shield Free VPN
 32            - omghfjlpggmjjaagoclmmobgdodcjboh # Browsec VPN
 33            - bibjcjfmgapbfoljiojpipaooddpkpai # VPN-free.pro
 34            - mpcaainmfjjigeicjnlkdfajbioopjko # VPN Unlimited Free
 35            - jljopmgdobloagejpohpldgkiellmfnc # PP VPN
 36            - lochiccbgeohimldjooaakjllnafhaid # IP Unblock
 37            - nhnfcgpcbfclhfafjlooihdfghaeinfc # Surf VPN
 38            - ookhnhpkphagefgdiemllfajmkdkcaim # iNinja VPN
 39            - namfblliamklmeodpcelkokjbffgmeoo # Daily VPN
 40            - nbcojefnccbanplpoffopkoepjmhgdgh # Hoxx VPN Proxy
 41            - majdfhpaihoncoakbjgbdhglocklcgno # Free VPN
 42            - lnfdmdhmfbimhhpaeocncdlhiodoblbd # VPN PROXY MASTER
 43            - eppiocemhmnlbhjplcgkofciiegomcon # Urban Free VPN
 44            - cocfojppfigjeefejbpfmedgjbpchcng # SaferVPN Proxy
 45            - foiopecknacmiihiocgdjgbjokkpkohc # VPN Professional
 46            - hhdobjgopfphlmjbmnpglhfcgppchgje # AdGuard VPN
 47            - jgbaghohigdbgbolncodkdlpenhcmcge # Free VPN
 48            - inligpkjkhbpifecbdjhmdpcfhnlelja # Free One Touch VPN
 49            - higioemojdadgdbhbbbkfbebbdlfjbip # Unlimited VPN & Proxy by ibVPN
 50            - hipncndjamdcmphkgngojegjblibadbe # RusVPN
 51            - iolonopooapdagdemdoaihahlfkncfgg # Azino VPN
 52            - nhfjkakglbnnpkpldhjmpmmfefifedcj # Pron VPN
 53            - jpgljfpmoofbmlieejglhonfofmahini # Free Residential VPN
 54            - fgddmllnllkalaagkghckoinaemmogpe # ExpressVPN
 55            - ejkaocphofnobjdedneohbbiilggdlbi # Hotspot Shield Elite VPN Proxy
 56            - keodbianoliadkoelloecbhllnpiocoi # Hide My IP VPN
 57            - hoapmlpnmpaehilehggglehfdlnoegck # Tunnello VPN
 58            - poeojclicodamonabcabmapamjkkmnnk # HMA VPN Proxy Unblocker
 59            - dfkdflfgjdajbhocmfjolpjbebdkcjog # Free Avira Phantom VPN
 60            - kcdahmgmaagjhocpipbodaokikjkampi # Hola VPN
 61            - klnkiajpmpkkkgpgbogmcgfjhdoljacg # Free VPN for Chrome
 62            - lneaocagcijjdpkcabeanfpdbmapcjjg # Hub VPN
 63            - pgfpignfckbloagkfnamnolkeaecfgfh # Free Proxy VPN
 64            - jplnlifepflhkbkgonidnobkakhmpnmh # Private Internet Access
 65            - jliodmnojccaloajphkingdnpljdhdok # Turbo VPN for PC
 66            - hnmpcagpplmpfojmgmnngilcnanddlhb # Windscribe
 67            - ffbkglfijbcbgblgflchnbphjdllaogb # CyberGhost VPN
 68            - kcndmbbelllkmioekdagahekgimemejo # VPN.AC
 69            - jdgilggpfmjpbodmhndmhojklgfdlhob # Browser VPN
 70            - bihhflimonbpcfagfadcnbbdngpopnjb # DEEPRISM VPN
 71            - ppajinakbfocjfnijggfndbdmjggcmde # My Browser Vpn
 72            - oofgbpoabipfcfjapgnbbjjaenockbdp # SetupVPN
 73            - bhnhkdgoefpmekcgnccpnhjfdgicfebm # Wachee VPN
 74            - knmmpciebaoojcpjjoeonlcjacjopcpf # Thunder Proxy
 75            - dhadilbmmjiooceioladdphemaliiobo # Free Proxy VPN
 76            - jedieiamjmoflcknjdjhpieklepfglin # FastestVPN Proxy
 77            - mhngpdlhojliikfknhfaglpnddniijfh # WorkingVPN
 78            - omdakjcmkglenbhjadbccaookpfjihpa # TunnelBear VPN
 79            - npgimkapccfidfkfoklhpkgmhgfejhbj # BelkaVPN
 80            - akeehkgglkmpapdnanoochpfmeghfdln # VPN Master
 81            - gbmdmipapolaohpinhblmcnpmmlgfgje # Unblock Websites
 82            - aigmfoeogfnljhnofglledbhhfegannp # Lethean Proxy VPN
 83            - cgojmfochfikphincbhokimmmjenhhgk # Whoer VPN
 84            - ficajfeojakddincjafebjmfiefcmanc # Best VPN USA
 85            - ifnaibldjfdmaipaddffmgcmekjhiloa # FREE VPN DEWELOPMENT
 86            - jbnmpdkcfkochpanomnkhnafobppmccn # apkfold free vpn
 87            - apcfdffemoinopelidncddjbhkiblecc # Soul VPN
 88            - mjolnodfokkkaichkcjipfgblbfgojpa # DotVPN
 89            - oifjbnnafapeiknapihcmpeodaeblbkn # rderzh VPN Proxy
 90            - plpmggfglncceinmilojdkiijhmajkjh # Red Panda VPN
 91            - mjnbclmflcpookeapghfhapeffmpodij # Ultrareach VPN
 92            - bblcccknbdbplgmdjnnikffefhdlobhp # FastStunnel VPN
 93            - aojlhgbkmkahabcmcpifbolnoichfeep # VirtualShield VPN
 94            - lcmammnjlbmlbcaniggmlejfjpjagiia # Adblock Office VPN Proxy Server
 95            - knajdeaocbpmfghhmijicidfcmdgbdpm # Guru VPN & Proxy
 96            - bdlcnpceagnkjnjlbbbcepohejbheilk # Malus VPN
 97            - edknjdjielmpdlnllkdmaghlbpnmjmgb # Muscle VPN
 98            - eidnihaadmmancegllknfbliaijfmkgo # Push VPN
 99            - ckiahbcmlmkpfiijecbpflfahoimklke # Gom VPN
100            - macdlemfnignjhclfcfichcdhiomgjjb # Free Fast VPN
101            - chioafkonnhbpajpengbalkececleldf # BullVPN
102            - amnoibeflfphhplmckdbiajkjaoomgnj # HideAll VPN
103            - llbhddikeonkpbhpncnhialfbpnilcnc # ProxyFlow
104            - pcienlhnoficegnepejpfiklggkioccm # Cloud VPN
105            - iocnglnmfkgfedpcemdflhkchokkfeii # sVPN
106            - igahhbkcppaollcjeaaoapkijbnphfhb # Social VPN
107            - njpmifchgidinihmijhcfpbdmglecdlb # Trellonet Trellonet
108            - ggackgngljinccllcmbgnpgpllcjepgc # WindmillVPN
109            - kchocjcihdgkoplngjemhpplmmloanja # IPBurger Proxy & VPN
110            - bnijmipndnicefcdbhgcjoognndbgkep # Veee
111            - lklekjodgannjcccdlbicoamibgbdnmi # Anonymous Proxy Vpn Browser
112            - dbdbnchagbkhknegmhgikkleoogjcfge # Hideman VPN
113            - egblhcjfjmbjajhjhpmnlekffgaemgfh # Fornex VPN
114            - ehbhfpfdkmhcpaehaooegfdflljcnfec # WeVPN
115            - bkkgdjpomdnfemhhkalfkogckjdkcjkg # VPNMatic
116            - almalgbpmcfpdaopimbdchdliminoign # Urban Shield
117            - akkbkhnikoeojlhiiomohpdnkhbkhieh # Prime VPN
118            - gbfgfbopcfokdpkdigfmoeaajfmpkbnh # westwind
119            - bniikohfmajhdcffljgfeiklcbgffppl # Upnet
120            - lejgfmmlngaigdmmikblappdafcmkndb # uVPN
121            - ffhhkmlgedgcliajaedapkdfigdobcif # Nucleus VPN
122            - gcknhkkoolaabfmlnjonogaaifnjlfnp # FoxyProxy Standard
123            - pooljnboifbodgifngpppfklhifechoe # GeoProxy
124            - fjoaledfpmneenckfbpdfhkmimnjocfa # NordVPN
125            - aakchaleigkohafkfjfjbblobjifikek # ProxFlow
126            - dpplabbmogkhghncfbfdeeokoefdjegm # Proxy SwitchySharp
127            - padekgcemlokbadohgkifijomclgjgif # Proxy SwitchyOmega
128            - bfidboloedlamgdmenmlbipfnccokknp # PureVPN
129    condition: all of chrome_*
130falsepositives:
131    - Unknown
132level: high