Running Chrome VPN Extensions via the Registry 2 VPN Extension

  1title: Running Chrome VPN Extensions via the Registry 2 VPN Extension
  2id: b64a026b-8deb-4c1d-92fd-98893209dff1
  3status: test
  4description: Running Chrome VPN Extensions via the Registry install 2 vpn extension
  5references:
  6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension
  7author: frack113
  8date: 2021/12/28
  9modified: 2023/08/17
 10tags:
 11    - attack.persistence
 12    - attack.t1133
 13logsource:
 14    category: registry_set
 15    product: windows
 16detection:
 17    chrome_ext:
 18        TargetObject|contains: 'Software\Wow6432Node\Google\Chrome\Extensions'
 19        TargetObject|endswith: 'update_url'
 20    chrome_vpn:
 21        TargetObject|contains:
 22            - fdcgdnkidjaadafnichfpabhfomcebme # ZenMate VPN
 23            - fcfhplploccackoneaefokcmbjfbkenj # 1clickVPN
 24            - bihmplhobchoageeokmgbdihknkjbknd # Touch VPN
 25            - gkojfkhlekighikafcpjkiklfbnlmeio # Hola Free VPN
 26            - jajilbjjinjmgcibalaakngmkilboobh # Astar VPN
 27            - gjknjjomckknofjidppipffbpoekiipm # VPN Free
 28            - nabbmpekekjknlbkgpodfndbodhijjem # Earth VPN
 29            - kpiecbcckbofpmkkkdibbllpinceiihk # DotVPN
 30            - nlbejmccbhkncgokjcmghpfloaajcffj # Hotspot Shield Free VPN
 31            - omghfjlpggmjjaagoclmmobgdodcjboh # Browsec VPN
 32            - bibjcjfmgapbfoljiojpipaooddpkpai # VPN-free.pro
 33            - mpcaainmfjjigeicjnlkdfajbioopjko # VPN Unlimited Free
 34            - jljopmgdobloagejpohpldgkiellmfnc # PP VPN
 35            - lochiccbgeohimldjooaakjllnafhaid # IP Unblock
 36            - nhnfcgpcbfclhfafjlooihdfghaeinfc # Surf VPN
 37            - ookhnhpkphagefgdiemllfajmkdkcaim # iNinja VPN
 38            - namfblliamklmeodpcelkokjbffgmeoo # Daily VPN
 39            - nbcojefnccbanplpoffopkoepjmhgdgh # Hoxx VPN Proxy
 40            - majdfhpaihoncoakbjgbdhglocklcgno # Free VPN
 41            - lnfdmdhmfbimhhpaeocncdlhiodoblbd # VPN PROXY MASTER
 42            - eppiocemhmnlbhjplcgkofciiegomcon # Urban Free VPN
 43            - cocfojppfigjeefejbpfmedgjbpchcng # SaferVPN Proxy
 44            - foiopecknacmiihiocgdjgbjokkpkohc # VPN Professional
 45            - hhdobjgopfphlmjbmnpglhfcgppchgje # AdGuard VPN
 46            - jgbaghohigdbgbolncodkdlpenhcmcge # Free VPN
 47            - inligpkjkhbpifecbdjhmdpcfhnlelja # Free One Touch VPN
 48            - higioemojdadgdbhbbbkfbebbdlfjbip # Unlimited VPN & Proxy by ibVPN
 49            - hipncndjamdcmphkgngojegjblibadbe # RusVPN
 50            - iolonopooapdagdemdoaihahlfkncfgg # Azino VPN
 51            - nhfjkakglbnnpkpldhjmpmmfefifedcj # Pron VPN
 52            - jpgljfpmoofbmlieejglhonfofmahini # Free Residential VPN
 53            - fgddmllnllkalaagkghckoinaemmogpe # ExpressVPN
 54            - ejkaocphofnobjdedneohbbiilggdlbi # Hotspot Shield Elite VPN Proxy
 55            - keodbianoliadkoelloecbhllnpiocoi # Hide My IP VPN
 56            - hoapmlpnmpaehilehggglehfdlnoegck # Tunnello VPN
 57            - poeojclicodamonabcabmapamjkkmnnk # HMA VPN Proxy Unblocker
 58            - dfkdflfgjdajbhocmfjolpjbebdkcjog # Free Avira Phantom VPN
 59            - kcdahmgmaagjhocpipbodaokikjkampi # Hola VPN
 60            - klnkiajpmpkkkgpgbogmcgfjhdoljacg # Free VPN for Chrome
 61            - lneaocagcijjdpkcabeanfpdbmapcjjg # Hub VPN
 62            - pgfpignfckbloagkfnamnolkeaecfgfh # Free Proxy VPN
 63            - jplnlifepflhkbkgonidnobkakhmpnmh # Private Internet Access
 64            - jliodmnojccaloajphkingdnpljdhdok # Turbo VPN for PC
 65            - hnmpcagpplmpfojmgmnngilcnanddlhb # Windscribe
 66            - ffbkglfijbcbgblgflchnbphjdllaogb # CyberGhost VPN
 67            - kcndmbbelllkmioekdagahekgimemejo # VPN.AC
 68            - jdgilggpfmjpbodmhndmhojklgfdlhob # Browser VPN
 69            - bihhflimonbpcfagfadcnbbdngpopnjb # DEEPRISM VPN
 70            - ppajinakbfocjfnijggfndbdmjggcmde # My Browser Vpn
 71            - oofgbpoabipfcfjapgnbbjjaenockbdp # SetupVPN
 72            - bhnhkdgoefpmekcgnccpnhjfdgicfebm # Wachee VPN
 73            - knmmpciebaoojcpjjoeonlcjacjopcpf # Thunder Proxy
 74            - dhadilbmmjiooceioladdphemaliiobo # Free Proxy VPN
 75            - jedieiamjmoflcknjdjhpieklepfglin # FastestVPN Proxy
 76            - mhngpdlhojliikfknhfaglpnddniijfh # WorkingVPN
 77            - omdakjcmkglenbhjadbccaookpfjihpa # TunnelBear VPN
 78            - npgimkapccfidfkfoklhpkgmhgfejhbj # BelkaVPN
 79            - akeehkgglkmpapdnanoochpfmeghfdln # VPN Master
 80            - gbmdmipapolaohpinhblmcnpmmlgfgje # Unblock Websites
 81            - aigmfoeogfnljhnofglledbhhfegannp # Lethean Proxy VPN
 82            - cgojmfochfikphincbhokimmmjenhhgk # Whoer VPN
 83            - ficajfeojakddincjafebjmfiefcmanc # Best VPN USA
 84            - ifnaibldjfdmaipaddffmgcmekjhiloa # FREE VPN DEWELOPMENT
 85            - jbnmpdkcfkochpanomnkhnafobppmccn # apkfold free vpn
 86            - apcfdffemoinopelidncddjbhkiblecc # Soul VPN
 87            - mjolnodfokkkaichkcjipfgblbfgojpa # DotVPN
 88            - oifjbnnafapeiknapihcmpeodaeblbkn # rderzh VPN Proxy
 89            - plpmggfglncceinmilojdkiijhmajkjh # Red Panda VPN
 90            - mjnbclmflcpookeapghfhapeffmpodij # Ultrareach VPN
 91            - bblcccknbdbplgmdjnnikffefhdlobhp # FastStunnel VPN
 92            - aojlhgbkmkahabcmcpifbolnoichfeep # VirtualShield VPN
 93            - lcmammnjlbmlbcaniggmlejfjpjagiia # Adblock Office VPN Proxy Server
 94            - knajdeaocbpmfghhmijicidfcmdgbdpm # Guru VPN & Proxy
 95            - bdlcnpceagnkjnjlbbbcepohejbheilk # Malus VPN
 96            - edknjdjielmpdlnllkdmaghlbpnmjmgb # Muscle VPN
 97            - eidnihaadmmancegllknfbliaijfmkgo # Push VPN
 98            - ckiahbcmlmkpfiijecbpflfahoimklke # Gom VPN
 99            - macdlemfnignjhclfcfichcdhiomgjjb # Free Fast VPN
100            - chioafkonnhbpajpengbalkececleldf # BullVPN
101            - amnoibeflfphhplmckdbiajkjaoomgnj # HideAll VPN
102            - llbhddikeonkpbhpncnhialfbpnilcnc # ProxyFlow
103            - pcienlhnoficegnepejpfiklggkioccm # Cloud VPN
104            - iocnglnmfkgfedpcemdflhkchokkfeii # sVPN
105            - igahhbkcppaollcjeaaoapkijbnphfhb # Social VPN
106            - njpmifchgidinihmijhcfpbdmglecdlb # Trellonet Trellonet
107            - ggackgngljinccllcmbgnpgpllcjepgc # WindmillVPN
108            - kchocjcihdgkoplngjemhpplmmloanja # IPBurger Proxy & VPN
109            - bnijmipndnicefcdbhgcjoognndbgkep # Veee
110            - lklekjodgannjcccdlbicoamibgbdnmi # Anonymous Proxy Vpn Browser
111            - dbdbnchagbkhknegmhgikkleoogjcfge # Hideman VPN
112            - egblhcjfjmbjajhjhpmnlekffgaemgfh # Fornex VPN
113            - ehbhfpfdkmhcpaehaooegfdflljcnfec # WeVPN
114            - bkkgdjpomdnfemhhkalfkogckjdkcjkg # VPNMatic
115            - almalgbpmcfpdaopimbdchdliminoign # Urban Shield
116            - akkbkhnikoeojlhiiomohpdnkhbkhieh # Prime VPN
117            - gbfgfbopcfokdpkdigfmoeaajfmpkbnh # westwind
118            - bniikohfmajhdcffljgfeiklcbgffppl # Upnet
119            - lejgfmmlngaigdmmikblappdafcmkndb # uVPN
120            - ffhhkmlgedgcliajaedapkdfigdobcif # Nucleus VPN
121            - gcknhkkoolaabfmlnjonogaaifnjlfnp # FoxyProxy Standard
122            - pooljnboifbodgifngpppfklhifechoe # GeoProxy
123            - fjoaledfpmneenckfbpdfhkmimnjocfa # NordVPN
124            - aakchaleigkohafkfjfjbblobjifikek # ProxFlow
125            - dpplabbmogkhghncfbfdeeokoefdjegm # Proxy SwitchySharp
126            - padekgcemlokbadohgkifijomclgjgif # Proxy SwitchyOmega
127            - bfidboloedlamgdmenmlbipfnccokknp # PureVPN
128    condition: all of chrome_*
129falsepositives:
130    - Unknown
131level: high