Activation sample sought a Defender exclusion for its own executable
A sandbox process tree records the sample launching a shell and WMIC to request an exclusion for its own path, with associated events naming additional paths. Two newly listed remote-administration files add a possible service-backed capability, but the record does not show that they were deployed with the sample or used for a remote session.
An executable running as program.exe launched cmd.exe, which launched WMIC with a request to add that same executable to Windows Defender’s exclusion list. The parent-child relationship is recorded in a CAPE Sandbox report—not merely inferred from a detection label. Other matched process events associated with the sample requested exclusions for an AAct_files directory and named executables and a DLL. The concrete finding is an attempt to change what Defender would inspect.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read