Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /im AdskLicensingAgent.exe /f
- '<SYSTEM32>\taskkill.exe' /f /im AdAppMgrSvc.exe
- '<SYSTEM32>\taskkill.exe' /f /im AutodeskDesktopApp.exe
- '<SYSTEM32>\taskkill.exe' /f /im AdskIdentityManager.exe
- '<SYSTEM32>\taskkill.exe' /f /im "Autodesk Access UI Host.exe"
- '<SYSTEM32>\taskkill.exe' /f /im "AdskAccessCore.exe"
Modifies file system
Creates the following files
- %TEMP%\adsk-nlm\nlm.mst
- %TEMP%\adsk-nlm\createlic.ps1
- %TEMP%\adsk-nlm\createlic.cmd
- %TEMP%\adsk-nlm\unnamed.json
- %TEMP%\adsk-nlm\delnowmic.ps1
- %TEMP%\adsk-nlm\nlm11.18.0.0_ipv4_ipv6_win64.msi
- %TEMP%\adsk-nlm\licenses.lic
- %TEMP%\adsk-nlm\version12.dll
- %TEMP%\adsk-nlm\adskflex.exe
- %TEMP%\adsk-nlm\version.dll
- %CommonProgramFiles(x86)%\autodesk shared\adsklicensing\current\adsklicensingagent\version.dll
- %WINDIR%\temp\~dff3c1024d9e236cc9.tmp
- %WINDIR%\installer\sourcehash{4be91685-1632-47fc-b563-a8a542c6664c}
- %WINDIR%\temp\~df6156c9c2c065cf00.tmp
- %WINDIR%\temp\~df52a49436d6d1f40f.tmp
- %WINDIR%\temp\~df43a490e6818aa682.tmp
- %WINDIR%\temp\~df58cb39785127d441.tmp
- %WINDIR%\temp\~df46b4d94b3f286591.tmp
- %WINDIR%\temp\~dfb79799f4f51547e3.tmp
- %WINDIR%\temp\~df78442eb303c33b5b.tmp
- %WINDIR%\temp\~dfe48a57d3a887e87b.tmp
- %WINDIR%\temp\~df4a672e19165a7ac2.tmp
- %WINDIR%\temp\~dfcb648ba8c66d9a8e.tmp
- %WINDIR%\temp\~dfc395dbf70ba26ecf.tmp
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\sc.exe' stop AdskLicensingService
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /hkry "%TEMP%\Adsk-NLM\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo D "
- '<SYSTEM32>\xcopy.exe' /hkry "%TEMP%\Adsk-NLM\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
- '<SYSTEM32>\cmd.exe' /c if exist "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "%TEMP%\Adsk-NLM\version12.dll" "%CommonProgra...
- '<SYSTEM32>\cmd.exe' /c if exist "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\12.#.1.5\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "%TEMP%\Adsk-NLM\version12.dll" "%CommonProgramFi...
- '<SYSTEM32>\cmd.exe' /c if exist "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "%TEMP%\Adsk-NLM\version12.dll" "%CommonProgra...
- '<SYSTEM32>\sc.exe' start AdskLicensingService
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Autodesk Access" /f
- '<SYSTEM32>\sc.exe' stop "Autodesk Access Service Host"
- '<SYSTEM32>\sc.exe' config "Autodesk Access Service Host" start= demand
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\Autodesk\AdskIdentityManager\uninstall.exe" --mode unattended
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended
- '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )
- '<SYSTEM32>\wbem\wmic.exe' product where name="Autodesk Single Sign On Component" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c del /q /f "%LOCALAPPDATA%\Autodesk\Genuine Autodesk Service\id.dat"
- '<SYSTEM32>\cmd.exe' /c ren "%ALLUSERSPROFILE%\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"
- '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )
- '<SYSTEM32>\wbem\wmic.exe' product where name="Autodesk Genuine Service" call uninstall /nointeractive
- '<SYSTEM32>\sc.exe' stop AdskNLM
- '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". '%T...
- '<SYSTEM32>\wbem\wmic.exe' product where name="Autodesk Network License Manager" call uninstall /nointeractive
- '<SYSTEM32>\cmd.exe' /c ren "%ALLUSERSPROFILE%\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\Adsk-NLM\nlm11.18.0.0_ipv4_ipv6_win64.msi" TRANSFORMS=nlm.mst INSTALLFOLDER="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager" /qn
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /hkry "%TEMP%\Adsk-NLM\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager"
- '<SYSTEM32>\xcopy.exe' /hkry "%TEMP%\Adsk-NLM\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adsk-NLM\createlic.cmd" "
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\wbem\wmic.exe' path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\wbem\wmic.exe' path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\sc.exe' create AdskNLM binPath= "\"%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayna...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f
- '<SYSTEM32>\sc.exe' stop AdskLicensingService' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /im AdskLicensingAgent.exe /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /hkry "%TEMP%\Adsk-NLM\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c if exist "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\12.0.0.6529\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "%TEMP%\Adsk-NLM\version12.dll" "%CommonProgra...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c if exist "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\12.#.1.5\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "%TEMP%\Adsk-NLM\version12.dll" "%CommonProgramFi...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c if exist "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\12.1.0.7121\AdskLicensingAgent\AdskLicensingAgent.exe" ( echo F | xcopy /hkry "%TEMP%\Adsk-NLM\version12.dll" "%CommonProgra...' (with hidden window)
- '<SYSTEM32>\sc.exe' start AdskLicensingService' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im AdAppMgrSvc.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im AutodeskDesktopApp.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im AdskIdentityManager.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im "Autodesk Access UI Host.exe"' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /f /im "AdskAccessCore.exe"' (with hidden window)
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Autodesk Access" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' stop "Autodesk Access Service Host"' (with hidden window)
- '<SYSTEM32>\sc.exe' config "Autodesk Access Service Host" start= demand' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\Autodesk\AdskIdentityManager\uninstall.exe" --mode unattended' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /q /f "%LOCALAPPDATA%\Autodesk\Genuine Autodesk Service\id.dat"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ren "%ALLUSERSPROFILE%\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )' (with hidden window)
- '<SYSTEM32>\sc.exe' stop AdskNLM' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c if exist "<SYSTEM32>\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". '%T...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ren "%ALLUSERSPROFILE%\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"' (with hidden window)
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\Adsk-NLM\nlm11.18.0.0_ipv4_ipv6_win64.msi" TRANSFORMS=nlm.mst INSTALLFOLDER="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager" /qn' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /hkry "%TEMP%\Adsk-NLM\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adsk-NLM\createlic.cmd" "' (with hidden window)
- '<SYSTEM32>\sc.exe' create AdskNLM binPath= "\"%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayna...' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f' (with hidden window)
