Analysis
-
max time kernel
24s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-06-2024 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
lowp.exe
Resource
win11-20240611-en
2 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
lowp.exe
-
Size
94KB
-
MD5
e37ff9b32fb4f1b72994fcf39148782a
-
SHA1
1d9ff72385401ba8a90a9a2f2e4299b88d869b28
-
SHA256
bf6da86c367afe64c5916b69100d1452ad796dbee9235be94530d1cf347b385c
-
SHA512
96586e6257791bce19ae5d90b8ace4b181b0b7948cd94810dddad4b48ec7f95e813df9d30a1650ce5b68d99207747a547f9cf628e9b2f19e2660c73b85b14291
-
SSDEEP
1536:mEHLyRfnlnChhC56r1t32uHzjWHFaND3m1qyN3HUnNBNJeOpSuDsWaWQzcdPdceH:mEORfnhgU8tGuWFaND34N32eOpNUWQCf
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
lowp.exedescription ioc process File opened for modification \??\PhysicalDrive0 lowp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lowp.exedescription pid process Token: SeShutdownPrivilege 4204 lowp.exe