9cbf4a9f365fa6e302cbeefe79fbb060e3281c1d8266e7485e82e8f78b3b56bc

Analysis

max time kernel
146s
max time network
41s
platform
windows7_x64
resource
win7v20210410
submitted
13/08/2021, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Autodesk License Patcher Ultimate Installer.exe
Size

10.6MB
MD5

a88f74305278474aefa30ec8d89ac91b
SHA1

2d8fe3cafb42e3d0264bba4807345d8e4aa13ba3
SHA256

9cbf4a9f365fa6e302cbeefe79fbb060e3281c1d8266e7485e82e8f78b3b56bc
SHA512

ee437f6e275a51474ef4b6de42a6e31c6600626545f712268a47f50bb6413912f9c6162453b1fba392dbe466498b10fa467fa213afcbdff605dd5278fd32d12a

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1772	lmgrd.exe
1552	adskflex.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 3 IoCs

pid	Process
1624	cmd.exe
1772	lmgrd.exe
1772	lmgrd.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\adlmint.dll	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\adlmint.dll	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.lic	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.lic	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.vbs	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.lic	powershell.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.vbs	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe	xcopy.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1528	schtasks.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 18 IoCs

evasion

pid	Process
872	taskkill.exe
1968	taskkill.exe
1528	taskkill.exe
1952	taskkill.exe
1732	taskkill.exe
1572	taskkill.exe
924	taskkill.exe
1900	taskkill.exe
1156	taskkill.exe
1492	taskkill.exe
988	taskkill.exe
384	taskkill.exe
1400	taskkill.exe
1840	taskkill.exe
1400	taskkill.exe
2044	taskkill.exe
840	taskkill.exe
1676	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1532	PING.EXE
588	PING.EXE
1032	PING.EXE
368	PING.EXE
936	PING.EXE
1536	PING.EXE
1036	PING.EXE
112	PING.EXE
292	PING.EXE
1840	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
960	powershell.exe
960	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	1156	taskkill.exe
Token: SeDebugPrivilege	1528	taskkill.exe
Token: SeDebugPrivilege	1400	taskkill.exe
Token: SeDebugPrivilege	1952	taskkill.exe
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	1732	taskkill.exe
Token: SeDebugPrivilege	840	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeShutdownPrivilege	1600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1420	msiexec.exe
Token: SeTakeOwnershipPrivilege	1420	msiexec.exe
Token: SeSecurityPrivilege	1420	msiexec.exe
Token: SeCreateTokenPrivilege	1600	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1600	msiexec.exe
Token: SeLockMemoryPrivilege	1600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1600	msiexec.exe
Token: SeMachineAccountPrivilege	1600	msiexec.exe
Token: SeTcbPrivilege	1600	msiexec.exe
Token: SeSecurityPrivilege	1600	msiexec.exe
Token: SeTakeOwnershipPrivilege	1600	msiexec.exe
Token: SeLoadDriverPrivilege	1600	msiexec.exe
Token: SeSystemProfilePrivilege	1600	msiexec.exe
Token: SeSystemtimePrivilege	1600	msiexec.exe
Token: SeProfSingleProcessPrivilege	1600	msiexec.exe
Token: SeIncBasePriorityPrivilege	1600	msiexec.exe
Token: SeCreatePagefilePrivilege	1600	msiexec.exe
Token: SeCreatePermanentPrivilege	1600	msiexec.exe
Token: SeBackupPrivilege	1600	msiexec.exe
Token: SeRestorePrivilege	1600	msiexec.exe
Token: SeShutdownPrivilege	1600	msiexec.exe
Token: SeDebugPrivilege	1600	msiexec.exe
Token: SeAuditPrivilege	1600	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1600	msiexec.exe
Token: SeChangeNotifyPrivilege	1600	msiexec.exe
Token: SeRemoteShutdownPrivilege	1600	msiexec.exe
Token: SeUndockPrivilege	1600	msiexec.exe
Token: SeSyncAgentPrivilege	1600	msiexec.exe
Token: SeEnableDelegationPrivilege	1600	msiexec.exe
Token: SeManageVolumePrivilege	1600	msiexec.exe
Token: SeImpersonatePrivilege	1600	msiexec.exe
Token: SeCreateGlobalPrivilege	1600	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2044	WMIC.exe
Token: SeSecurityPrivilege	2044	WMIC.exe
Token: SeTakeOwnershipPrivilege	2044	WMIC.exe
Token: SeLoadDriverPrivilege	2044	WMIC.exe
Token: SeSystemProfilePrivilege	2044	WMIC.exe
Token: SeSystemtimePrivilege	2044	WMIC.exe
Token: SeProfSingleProcessPrivilege	2044	WMIC.exe
Token: SeIncBasePriorityPrivilege	2044	WMIC.exe
Token: SeCreatePagefilePrivilege	2044	WMIC.exe
Token: SeBackupPrivilege	2044	WMIC.exe
Token: SeRestorePrivilege	2044	WMIC.exe
Token: SeShutdownPrivilege	2044	WMIC.exe
Token: SeDebugPrivilege	2044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2044	WMIC.exe
Token: SeRemoteShutdownPrivilege	2044	WMIC.exe
Token: SeUndockPrivilege	2044	WMIC.exe
Token: SeManageVolumePrivilege	2044	WMIC.exe
Token: 33	2044	WMIC.exe
Token: 34	2044	WMIC.exe
Token: 35	2044	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2044	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1688	1084	Autodesk License Patcher Ultimate Installer.exe	28
PID 1084 wrote to memory of 1688	1084	Autodesk License Patcher Ultimate Installer.exe	28
PID 1084 wrote to memory of 1688	1084	Autodesk License Patcher Ultimate Installer.exe	28
PID 1084 wrote to memory of 1688	1084	Autodesk License Patcher Ultimate Installer.exe	28
PID 1084 wrote to memory of 1688	1084	Autodesk License Patcher Ultimate Installer.exe	28
PID 1084 wrote to memory of 1688	1084	Autodesk License Patcher Ultimate Installer.exe	28
PID 1084 wrote to memory of 1688	1084	Autodesk License Patcher Ultimate Installer.exe	28
PID 1688 wrote to memory of 1628	1688	cmd.exe	31
PID 1688 wrote to memory of 1628	1688	cmd.exe	31
PID 1688 wrote to memory of 1628	1688	cmd.exe	31
PID 1688 wrote to memory of 1628	1688	cmd.exe	31
PID 1688 wrote to memory of 1512	1688	cmd.exe	32
PID 1688 wrote to memory of 1512	1688	cmd.exe	32
PID 1688 wrote to memory of 1512	1688	cmd.exe	32
PID 1688 wrote to memory of 1512	1688	cmd.exe	32
PID 1688 wrote to memory of 1532	1688	cmd.exe	33
PID 1688 wrote to memory of 1532	1688	cmd.exe	33
PID 1688 wrote to memory of 1532	1688	cmd.exe	33
PID 1688 wrote to memory of 1532	1688	cmd.exe	33
PID 1688 wrote to memory of 1036	1688	cmd.exe	34
PID 1688 wrote to memory of 1036	1688	cmd.exe	34
PID 1688 wrote to memory of 1036	1688	cmd.exe	34
PID 1688 wrote to memory of 1036	1688	cmd.exe	34
PID 1688 wrote to memory of 568	1688	cmd.exe	35
PID 1688 wrote to memory of 568	1688	cmd.exe	35
PID 1688 wrote to memory of 568	1688	cmd.exe	35
PID 1688 wrote to memory of 568	1688	cmd.exe	35
PID 568 wrote to memory of 828	568	net.exe	36
PID 568 wrote to memory of 828	568	net.exe	36
PID 568 wrote to memory of 828	568	net.exe	36
PID 568 wrote to memory of 828	568	net.exe	36
PID 1688 wrote to memory of 1968	1688	cmd.exe	37
PID 1688 wrote to memory of 1968	1688	cmd.exe	37
PID 1688 wrote to memory of 1968	1688	cmd.exe	37
PID 1688 wrote to memory of 1968	1688	cmd.exe	37
PID 1688 wrote to memory of 1156	1688	cmd.exe	39
PID 1688 wrote to memory of 1156	1688	cmd.exe	39
PID 1688 wrote to memory of 1156	1688	cmd.exe	39
PID 1688 wrote to memory of 1156	1688	cmd.exe	39
PID 1688 wrote to memory of 1528	1688	cmd.exe	40
PID 1688 wrote to memory of 1528	1688	cmd.exe	40
PID 1688 wrote to memory of 1528	1688	cmd.exe	40
PID 1688 wrote to memory of 1528	1688	cmd.exe	40
PID 1688 wrote to memory of 1400	1688	cmd.exe	41
PID 1688 wrote to memory of 1400	1688	cmd.exe	41
PID 1688 wrote to memory of 1400	1688	cmd.exe	41
PID 1688 wrote to memory of 1400	1688	cmd.exe	41
PID 1688 wrote to memory of 1952	1688	cmd.exe	42
PID 1688 wrote to memory of 1952	1688	cmd.exe	42
PID 1688 wrote to memory of 1952	1688	cmd.exe	42
PID 1688 wrote to memory of 1952	1688	cmd.exe	42
PID 1688 wrote to memory of 2044	1688	cmd.exe	43
PID 1688 wrote to memory of 2044	1688	cmd.exe	43
PID 1688 wrote to memory of 2044	1688	cmd.exe	43
PID 1688 wrote to memory of 2044	1688	cmd.exe	43
PID 1688 wrote to memory of 1732	1688	cmd.exe	44
PID 1688 wrote to memory of 1732	1688	cmd.exe	44
PID 1688 wrote to memory of 1732	1688	cmd.exe	44
PID 1688 wrote to memory of 1732	1688	cmd.exe	44
PID 1688 wrote to memory of 840	1688	cmd.exe	45
PID 1688 wrote to memory of 840	1688	cmd.exe	45
PID 1688 wrote to memory of 840	1688	cmd.exe	45
PID 1688 wrote to memory of 840	1688	cmd.exe	45
PID 1688 wrote to memory of 1676	1688	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\Autodesk License Patcher Ultimate Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Autodesk License Patcher Ultimate Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\AutodeskLicensePatcherInstaller\AutodeskLicensePatcherInstaller.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\mode.com
    mode con: cols=70 lines=15
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\chcp.com
    chcp 1254
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 15
    3⤵
    - Runs ping.exe
    PID:1532
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1036
- - C:\Windows\SysWOW64\net.exe
    net stop AdskLicensingService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AdskLicensingService
      4⤵
      PID:828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingAgent.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "ADPClientService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingAnalyticsClient.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingInstHelper.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "lmgrd.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "adskflex.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "lmutil.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "lmtools.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec.exe /X {4BE91685-1632-47FC-B563-A8A542C6664C} /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1600
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:588
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:1924
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\lmgrd.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:568
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\License.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:760
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\Service\Service.vbs" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:1968
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\Service\Service.bat" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:240
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\AdskLicensingService.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:1156
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\AdskLicensingAgent.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:924
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\adlmint.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:1528
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c hostname
    3⤵
    PID:1104
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
    3⤵
    PID:1764
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
    3⤵
    PID:1512
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
      4⤵
      PID:1592
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(gc License.lic) -replace 'MAC', '42C11A88956C ' -replace 'HOSTNAME', 'Mrbkymno' | Out-File -encoding ASCII License.lic"
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:960
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:292
- - C:\Windows\SysWOW64\sc.exe
    sc config AdskLicensingService Start=Auto
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Delete /tn "Autodesk" /f
    3⤵
    PID:924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /XML C:\AutodeskLicensePatcherInstaller\Files\Task\Autodesk.xml /tn "\Microsoft\Windows\Autodesk\Autodesk"
    3⤵
    - Creates scheduled task(s)
    PID:1528
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1840
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="AutodeskNLM"
    3⤵
    PID:112
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:928
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:988
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:960
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:292
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:960
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:292
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:884
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:112
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:928
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:988
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:760
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe"
    3⤵
    PID:904
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1032
- - C:\Windows\SysWOW64\net.exe
    net start AdskLicensingService
    3⤵
    PID:764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start AdskLicensingService
      4⤵
      PID:800
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:368
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.vbs" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat"
    3⤵
    PID:1708
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat" "
      4⤵
      Loads dropped DLL
      PID:1624
    - - C:\Windows\SysWOW64\mode.com
        
        mode con: cols=70 lines=12
        5⤵
        
        PID:972
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1254
        5⤵
        
        PID:1692
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        Runs ping.exe
        
        PID:1536
    - - C:\Windows\SysWOW64\net.exe
        
        net stop AdskLicensingService
        5⤵
        
        PID:1508
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AdskLicensingService
        6⤵
        
        PID:1036
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingService.exe"
        5⤵
        Kills process with taskkill
        
        PID:1492
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingAgent.exe"
        5⤵
        Kills process with taskkill
        
        PID:988
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "ADPClientService.exe"
        5⤵
        Kills process with taskkill
        
        PID:1572
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingAnalyticsClient.exe"
        5⤵
        Kills process with taskkill
        
        PID:872
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingInstHelper.exe"
        5⤵
        Kills process with taskkill
        
        PID:924
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "lmgrd.exe"
        5⤵
        Kills process with taskkill
        
        PID:384
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "adskflex.exe"
        5⤵
        Kills process with taskkill
        
        PID:1400
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "lmutil.exe"
        5⤵
        Kills process with taskkill
        
        PID:1840
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "lmtools.exe"
        5⤵
        Kills process with taskkill
        
        PID:1900
    - - C:\Windows\SysWOW64\net.exe
        
        net start AdskLicensingService
        5⤵
        
        PID:1252
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start AdskLicensingService
        6⤵
        
        PID:1312
    - - C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
        
        lmgrd.exe -z -c License.lic
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1772
      - C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe
        
        adskflex.exe -T Mrbkymno 11.18 -1 -c ";License.lic;" -lmgrd_port 6978 -srv E9hgEMr2Awep8sexFkQ13zMpM4f0Zb7uqZrXSM6zNl4gNNV7Kj80bYFHSbwil38 --lmgrd_start 61161ef7 -vdrestart 0
        6⤵
        Executes dropped EXE
        
        PID:1552
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-109-0x00000000047C2000-0x00000000047C3000-memory.dmp

Filesize
4KB

Download
memory/960-114-0x00000000061F0000-0x00000000061F1000-memory.dmp

Filesize
4KB

Download
memory/960-131-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/960-129-0x00000000064F0000-0x00000000064F1000-memory.dmp

Filesize
4KB

Download
memory/960-106-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/960-107-0x0000000004800000-0x0000000004801000-memory.dmp

Filesize
4KB

Download
memory/960-108-0x00000000047C0000-0x00000000047C1000-memory.dmp

Filesize
4KB

Download
memory/960-127-0x00000000064B0000-0x00000000064B1000-memory.dmp

Filesize
4KB

Download
memory/960-110-0x0000000004740000-0x0000000004741000-memory.dmp

Filesize
4KB

Download
memory/960-111-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/960-120-0x0000000006300000-0x0000000006301000-memory.dmp

Filesize
4KB

Download
memory/960-119-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/1084-59-0x0000000076E11000-0x0000000076E13000-memory.dmp

Filesize
8KB

Download
memory/1420-79-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Filesize
8KB

Download