Find similar analyses in TI Lookup

Analysis date (UTC): 12 October 2021, 16:25Analysis environment: Windows 7 Pro, build 7601, x86

https://chrome.google.com/webstore/detail/browsec-vpn-free-vpn-for/omghfjlpggmjjaagoclmmobgdodcjboh?hl=en&ucbcb=1

MD5:3779014F54CB8FC78B1AA7288C5FD76B

SHA1:84D508EF8E9D4A2730F5371E32BF88BE549E6605

SHA256:5FBCC9150A31E7833880AACD8E5AA11383125CD18BEF36D6C330849383E9D947

Analysis result

Threat level:Malicious activity

Full analysis:Analysis https://chrome.google.com/webstore/detail/browsec-vpn-free-vpn-for/omghfjlpggmjjaagoclmmobgdodcjboh?hl=en&ucbcb=1 Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Modifies files in Chrome extension folder

chrome.exe (PID: 620)

INFO

Reads the computer name

chrome.exe (PID: 620)
chrome.exe (PID: 784)
chrome.exe (PID: 2580)
chrome.exe (PID: 2908)
chrome.exe (PID: 3752)
chrome.exe (PID: 3628)
chrome.exe (PID: 2800)
chrome.exe (PID: 2264)
chrome.exe (PID: 2652)
chrome.exe (PID: 2432)
chrome.exe (PID: 2868)

Checks supported languages

Application launched itself

chrome.exe (PID: 620)

Reads the hosts file

chrome.exe (PID: 620)
chrome.exe (PID: 784)

Reads settings of System Certificates

chrome.exe (PID: 784)

Checks Windows Trust Settings

chrome.exe (PID: 620)

Reads the date of Windows installation

chrome.exe (PID: 2432)

Threats

PID	Process	Class	Message
784	chrome.exe	Generic Protocol Command Decode	SURICATA STREAM CLOSEWAIT FIN out of window
784	chrome.exe	Generic Protocol Command Decode	SURICATA HTTP unable to match response to request
784	chrome.exe	Generic Protocol Command Decode	SURICATA HTTP unable to match response to request