hxxp://frozenreborn[.]cc

Analysis

user interaction
yes
max time kernel
13s
max time network
16s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://frozenreborn.cc
Sample260419-bval8agw2w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210356645260662"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe
Token: SeShutdownPrivilege	2032	chrome.exe
Token: SeCreatePagefilePrivilege	2032	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe
2032	chrome.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1888	2032	chrome.exe	80
PID 2032 wrote to memory of 4976	2032	chrome.exe	81
PID 2032 wrote to memory of 4968	2032	chrome.exe	82
PID 2032 wrote to memory of 4968	2032	chrome.exe	82
PID 2032 wrote to memory of 4200	2032	chrome.exe	83
PID 2032 wrote to memory of 4200	2032	chrome.exe	83
PID 2032 wrote to memory of 2348	2032	chrome.exe	84
PID 2032 wrote to memory of 1744	2032	chrome.exe	85
PID 2032 wrote to memory of 2348	2032	chrome.exe	84
PID 2032 wrote to memory of 1744	2032	chrome.exe	85
PID 2032 wrote to memory of 1472	2032	chrome.exe	86
PID 2032 wrote to memory of 1472	2032	chrome.exe	86
PID 2032 wrote to memory of 3180	2032	chrome.exe	89
PID 2032 wrote to memory of 3180	2032	chrome.exe	89
PID 2032 wrote to memory of 1692	2032	chrome.exe	90

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://frozenreborn.cc
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84ad9c728,0x7ff84ad9c734,0x7ff84ad9c740
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,14969949463203096023,18349616801346049667,524288 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2160 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,8673541243525604059,967695972506274526,262144 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,2014931652729329062,17573298101775634943,524288 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2260 /prefetch:13
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,18178123420640188080,8325963983333848860,2097152 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3168,i,572661226374666734,14075865999427888109,2097152 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,10200880132881282513,18028480707723963436,2097152 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,8204812464408153922,13174646031191810036,2097152 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4536,i,17934385597420677533,7347913334479027769,524288 --field-trial-handle=2132,i,4976143274575632956,10103813779495265294,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:1692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d62770ee2bab400729f5109c75e054fa83977220ea705b846396bdb78cbe7268
MD5 ff0f71fdceb2a36c3d45469111ae3fba
SHA1 1a0ab23c45aa240f4eca3f042705d28830abb611
SHA512 299cc3af16ac6eeaf20ec1be838def56403221100ce2015e929e5ec9575c664be7f0a6f30f328326cf5540c54bd64bcdd25bb7ad2f6f10ecbf74608b1446d7b4
TLSH
T191E02BAECC21D82B08FD0B1A60504BC6E70003572751858B3B3C811D4FF027B46D581C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 772d4305c0f7e6b66725a2f4212eb926d912a2938aab9da158e0cfb519ec882c
MD5 d1a5bf25fbbd16f2e21bdc90ec9f69be
SHA1 7de9f6079940f421e3238e48e51fe8606915ca37
SHA512 731d753a496772a0d04824d1d974b5f36907af9d6e3f62c1e40c2b4c4aab458d2d7d194fac3656ed0310e15f137757a8380813a36641587f376b693fc0fb8963
SSDEEP 192:NRgtJuB121rS8Qvfv7dpAPRp2n19ZHsb+WNnCRSWN2+1vag28rC6+VyIsnAUge:NRKJuBQSZ3pUXqHwMV2sar62e
TLSH
T1EB42932EED14693B5CCAD21AF961B75BE7F5102521D42EC4E7F8CA2C14E79CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 815f7cf2441d8bbd1e771118781b4364aae22d7489793b4db97b9f0119d089e3
MD5 6c2a084e9725415d6e6f241570b51988
SHA1 f7e51421dd3914c45e248d5cfdbcc1ccdd7b1907
SHA512 0f2edbb6a76239ee35ba77bd8dd350b86c055aaafae69ff2d50a4140d561c818f0c11904a51a61bac41705a0c50d69925327d1db674cd222f87fa3c49aced588
SSDEEP 384:ZXjVs7KxkXqKf/pUZNCgVLH2Hfgslps7pLuLcifzOXODV0+ErU3O2HG4YpPlG/:ZzVs7KxkXqKf/pUZNCgVLH2HfgsPs7p4
TLSH
T1D772F9676C4C9A770F94CACCD81A7B4FADB5024B65D9886483FA9C2A03D5ECF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 691cdecfcb3e92d5541c4546aa1a97cedd430a2f698ce75b67cfa03aca039161
MD5 21843d6031c8ded1a4585140c37a1745
SHA1 5e788a432fb04c5085cba481c04ebeaaa4d9132b
SHA512 ff62c3e5be77cf02dd801bd17bac59e43cede69756f61bef57c82af63fd0756d36cf169b0978a848802ff90c1c0276ac781eed96c1d2736c7f9dadaf1edbdb57
SSDEEP 1536:X4P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:u++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T18B9302BD991E7C79536BC696A0079DAC8CD3DCCD111451BC30C76B1E14BA3A3A31B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 51983b3188ec68aeeb8ea95b2729fa9649293310c540f8325614cd5647d536b3
MD5 c8d9427919f7d498e4136da30344f91b
SHA1 8bf0b1954c95cd9a6812469e0e2dfb5cdce900bd
SHA512 efb6b12fbbd493683e7f513c30806e90ac49d7b3008275a0b700baa5327a00f9868043e3d292bb4c6f5b440d78033263044a37ce5a8afd55b5ab5b782e1c88dc
SSDEEP 1536:fAxm0P++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNc:6v++J3qUQm08KMWF0bFTcVHr6zb
TLSH
T13F9312B9AD0E7C75235BD6A690079CAC8CD3DCCE1614157C30C76F1E14FA392A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3572-13-0x0000025523670000-0x000002552371F000-memory.dmp

Download