9cbf4a9f365fa6e302cbeefe79fbb060e3281c1d8266e7485e82e8f78b3b56bc

Analysis

max time kernel
148s
max time network
115s
platform
windows10_x64
resource
win10v20210408
submitted
13/08/2021, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Autodesk License Patcher Ultimate Installer.exe
Size

10.6MB
MD5

a88f74305278474aefa30ec8d89ac91b
SHA1

2d8fe3cafb42e3d0264bba4807345d8e4aa13ba3
SHA256

9cbf4a9f365fa6e302cbeefe79fbb060e3281c1d8266e7485e82e8f78b3b56bc
SHA512

ee437f6e275a51474ef4b6de42a6e31c6600626545f712268a47f50bb6413912f9c6162453b1fba392dbe466498b10fa467fa213afcbdff605dd5278fd32d12a

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
636	lmgrd.exe
2292	adskflex.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\adlmint.dll	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.lic	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.vbs	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.lic	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.vbs	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe	xcopy.exe
File created	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\adlmint.dll	xcopy.exe
File opened for modification	C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\License.lic	powershell.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3952	schtasks.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 18 IoCs

evasion

pid	Process
2240	taskkill.exe
1296	taskkill.exe
1620	taskkill.exe
1540	taskkill.exe
4036	taskkill.exe
2964	taskkill.exe
3932	taskkill.exe
992	taskkill.exe
1172	taskkill.exe
2860	taskkill.exe
564	taskkill.exe
2556	taskkill.exe
2164	taskkill.exe
4024	taskkill.exe
2252	taskkill.exe
2176	taskkill.exe
792	taskkill.exe
3676	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
200	PING.EXE
2016	PING.EXE
1596	PING.EXE
2956	PING.EXE
1180	PING.EXE
1304	PING.EXE
1504	PING.EXE
3576	PING.EXE
4052	PING.EXE
3124	PING.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4028	powershell.exe
4028	powershell.exe
4028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	792	taskkill.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeDebugPrivilege	2860	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	3932	taskkill.exe
Token: SeDebugPrivilege	3676	taskkill.exe
Token: SeShutdownPrivilege	2172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2172	msiexec.exe
Token: SeSecurityPrivilege	988	msiexec.exe
Token: SeCreateTokenPrivilege	2172	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2172	msiexec.exe
Token: SeLockMemoryPrivilege	2172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2172	msiexec.exe
Token: SeMachineAccountPrivilege	2172	msiexec.exe
Token: SeTcbPrivilege	2172	msiexec.exe
Token: SeSecurityPrivilege	2172	msiexec.exe
Token: SeTakeOwnershipPrivilege	2172	msiexec.exe
Token: SeLoadDriverPrivilege	2172	msiexec.exe
Token: SeSystemProfilePrivilege	2172	msiexec.exe
Token: SeSystemtimePrivilege	2172	msiexec.exe
Token: SeProfSingleProcessPrivilege	2172	msiexec.exe
Token: SeIncBasePriorityPrivilege	2172	msiexec.exe
Token: SeCreatePagefilePrivilege	2172	msiexec.exe
Token: SeCreatePermanentPrivilege	2172	msiexec.exe
Token: SeBackupPrivilege	2172	msiexec.exe
Token: SeRestorePrivilege	2172	msiexec.exe
Token: SeShutdownPrivilege	2172	msiexec.exe
Token: SeDebugPrivilege	2172	msiexec.exe
Token: SeAuditPrivilege	2172	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2172	msiexec.exe
Token: SeChangeNotifyPrivilege	2172	msiexec.exe
Token: SeRemoteShutdownPrivilege	2172	msiexec.exe
Token: SeUndockPrivilege	2172	msiexec.exe
Token: SeSyncAgentPrivilege	2172	msiexec.exe
Token: SeEnableDelegationPrivilege	2172	msiexec.exe
Token: SeManageVolumePrivilege	2172	msiexec.exe
Token: SeImpersonatePrivilege	2172	msiexec.exe
Token: SeCreateGlobalPrivilege	2172	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3736	WMIC.exe
Token: SeSecurityPrivilege	3736	WMIC.exe
Token: SeTakeOwnershipPrivilege	3736	WMIC.exe
Token: SeLoadDriverPrivilege	3736	WMIC.exe
Token: SeSystemProfilePrivilege	3736	WMIC.exe
Token: SeSystemtimePrivilege	3736	WMIC.exe
Token: SeProfSingleProcessPrivilege	3736	WMIC.exe
Token: SeIncBasePriorityPrivilege	3736	WMIC.exe
Token: SeCreatePagefilePrivilege	3736	WMIC.exe
Token: SeBackupPrivilege	3736	WMIC.exe
Token: SeRestorePrivilege	3736	WMIC.exe
Token: SeShutdownPrivilege	3736	WMIC.exe
Token: SeDebugPrivilege	3736	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3736	WMIC.exe
Token: SeRemoteShutdownPrivilege	3736	WMIC.exe
Token: SeUndockPrivilege	3736	WMIC.exe
Token: SeManageVolumePrivilege	3736	WMIC.exe
Token: 33	3736	WMIC.exe
Token: 34	3736	WMIC.exe
Token: 35	3736	WMIC.exe
Token: 36	3736	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3736	WMIC.exe
Token: SeSecurityPrivilege	3736	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 708	568	Autodesk License Patcher Ultimate Installer.exe	75
PID 568 wrote to memory of 708	568	Autodesk License Patcher Ultimate Installer.exe	75
PID 568 wrote to memory of 708	568	Autodesk License Patcher Ultimate Installer.exe	75
PID 708 wrote to memory of 2964	708	cmd.exe	78
PID 708 wrote to memory of 2964	708	cmd.exe	78
PID 708 wrote to memory of 2964	708	cmd.exe	78
PID 708 wrote to memory of 4032	708	cmd.exe	79
PID 708 wrote to memory of 4032	708	cmd.exe	79
PID 708 wrote to memory of 4032	708	cmd.exe	79
PID 708 wrote to memory of 1180	708	cmd.exe	80
PID 708 wrote to memory of 1180	708	cmd.exe	80
PID 708 wrote to memory of 1180	708	cmd.exe	80
PID 708 wrote to memory of 1304	708	cmd.exe	84
PID 708 wrote to memory of 1304	708	cmd.exe	84
PID 708 wrote to memory of 1304	708	cmd.exe	84
PID 708 wrote to memory of 1148	708	cmd.exe	85
PID 708 wrote to memory of 1148	708	cmd.exe	85
PID 708 wrote to memory of 1148	708	cmd.exe	85
PID 1148 wrote to memory of 4052	1148	net.exe	86
PID 1148 wrote to memory of 4052	1148	net.exe	86
PID 1148 wrote to memory of 4052	1148	net.exe	86
PID 708 wrote to memory of 1540	708	cmd.exe	87
PID 708 wrote to memory of 1540	708	cmd.exe	87
PID 708 wrote to memory of 1540	708	cmd.exe	87
PID 708 wrote to memory of 792	708	cmd.exe	88
PID 708 wrote to memory of 792	708	cmd.exe	88
PID 708 wrote to memory of 792	708	cmd.exe	88
PID 708 wrote to memory of 4036	708	cmd.exe	89
PID 708 wrote to memory of 4036	708	cmd.exe	89
PID 708 wrote to memory of 4036	708	cmd.exe	89
PID 708 wrote to memory of 2860	708	cmd.exe	90
PID 708 wrote to memory of 2860	708	cmd.exe	90
PID 708 wrote to memory of 2860	708	cmd.exe	90
PID 708 wrote to memory of 564	708	cmd.exe	91
PID 708 wrote to memory of 564	708	cmd.exe	91
PID 708 wrote to memory of 564	708	cmd.exe	91
PID 708 wrote to memory of 2964	708	cmd.exe	92
PID 708 wrote to memory of 2964	708	cmd.exe	92
PID 708 wrote to memory of 2964	708	cmd.exe	92
PID 708 wrote to memory of 2164	708	cmd.exe	93
PID 708 wrote to memory of 2164	708	cmd.exe	93
PID 708 wrote to memory of 2164	708	cmd.exe	93
PID 708 wrote to memory of 3932	708	cmd.exe	94
PID 708 wrote to memory of 3932	708	cmd.exe	94
PID 708 wrote to memory of 3932	708	cmd.exe	94
PID 708 wrote to memory of 3676	708	cmd.exe	95
PID 708 wrote to memory of 3676	708	cmd.exe	95
PID 708 wrote to memory of 3676	708	cmd.exe	95
PID 708 wrote to memory of 2172	708	cmd.exe	96
PID 708 wrote to memory of 2172	708	cmd.exe	96
PID 708 wrote to memory of 2172	708	cmd.exe	96
PID 708 wrote to memory of 1504	708	cmd.exe	98
PID 708 wrote to memory of 1504	708	cmd.exe	98
PID 708 wrote to memory of 1504	708	cmd.exe	98
PID 708 wrote to memory of 3600	708	cmd.exe	99
PID 708 wrote to memory of 3600	708	cmd.exe	99
PID 708 wrote to memory of 3600	708	cmd.exe	99
PID 708 wrote to memory of 1644	708	cmd.exe	100
PID 708 wrote to memory of 1644	708	cmd.exe	100
PID 708 wrote to memory of 1644	708	cmd.exe	100
PID 708 wrote to memory of 2364	708	cmd.exe	101
PID 708 wrote to memory of 2364	708	cmd.exe	101
PID 708 wrote to memory of 2364	708	cmd.exe	101
PID 708 wrote to memory of 2124	708	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\Autodesk License Patcher Ultimate Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Autodesk License Patcher Ultimate Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\AutodeskLicensePatcherInstaller\AutodeskLicensePatcherInstaller.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\mode.com
    mode con: cols=70 lines=15
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\chcp.com
    chcp 1254
    3⤵
    PID:4032
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 15
    3⤵
    - Runs ping.exe
    PID:1180
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1304
- - C:\Windows\SysWOW64\net.exe
    net stop AdskLicensingService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop AdskLicensingService
      4⤵
      PID:4052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingAgent.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "ADPClientService.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingAnalyticsClient.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "AdskLicensingInstHelper.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "lmgrd.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "adskflex.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "lmutil.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "lmtools.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- - C:\Windows\SysWOW64\msiexec.exe
    MsiExec.exe /X {4BE91685-1632-47FC-B563-A8A542C6664C} /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1504
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:3600
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\lmgrd.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:1644
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\License.lic" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:2364
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\Service\Service.vbs" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:2124
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\Service\Service.bat" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:3152
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\AdskLicensingService.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:1660
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\AdskLicensingAgent.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:2344
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\adlmint.dll" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\" /Y /K /R /S /H /i
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    PID:2312
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c hostname
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      hostname
      4⤵
      PID:1004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
    3⤵
    PID:2860
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
    3⤵
    PID:4032
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
      4⤵
      PID:3968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(gc License.lic) -replace 'MAC', 'E2597A2395CA ' -replace 'HOSTNAME', 'Gfbfpsxa' | Out-File -encoding ASCII License.lic"
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4028
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:200
- - C:\Windows\SysWOW64\sc.exe
    sc config AdskLicensingService Start=Auto
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Delete /tn "Autodesk" /f
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /XML C:\AutodeskLicensePatcherInstaller\Files\Task\Autodesk.xml /tn "\Microsoft\Windows\Autodesk\Autodesk"
    3⤵
    - Creates scheduled task(s)
    PID:3952
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:2016
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="AutodeskNLM"
    3⤵
    PID:3980
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:2888
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:3544
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:184
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe"
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\ADPClientService.exe"
    3⤵
    PID:3208
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient\AdskLicensingAnalyticsClient.exe"
    3⤵
    PID:1412
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\CER\senddmp.exe"
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\helper\AdskLicensingInstHelper.exe"
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:996
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\AdskLicensingAgent.exe"
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\11.0.0.4854\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe"
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe"
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:1596
- - C:\Windows\SysWOW64\net.exe
    net start AdskLicensingService
    3⤵
    PID:1180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start AdskLicensingService
      4⤵
      PID:3952
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:4052
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.vbs" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat"
    3⤵
    PID:1540
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\Service.bat" "
      4⤵
      PID:1736
    - - C:\Windows\SysWOW64\mode.com
        
        mode con: cols=70 lines=12
        5⤵
        
        PID:3472
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1254
        5⤵
        
        PID:4036
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        Runs ping.exe
        
        PID:3124
    - - C:\Windows\SysWOW64\net.exe
        
        net stop AdskLicensingService
        5⤵
        
        PID:1640
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AdskLicensingService
        6⤵
        
        PID:2760
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingService.exe"
        5⤵
        Kills process with taskkill
        
        PID:2252
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingAgent.exe"
        5⤵
        Kills process with taskkill
        
        PID:2176
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "ADPClientService.exe"
        5⤵
        Kills process with taskkill
        
        PID:4024
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingAnalyticsClient.exe"
        5⤵
        Kills process with taskkill
        
        PID:2240
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "AdskLicensingInstHelper.exe"
        5⤵
        Kills process with taskkill
        
        PID:1296
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "lmgrd.exe"
        5⤵
        Kills process with taskkill
        
        PID:992
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "adskflex.exe"
        5⤵
        Kills process with taskkill
        
        PID:1172
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "lmutil.exe"
        5⤵
        Kills process with taskkill
        
        PID:2556
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "lmtools.exe"
        5⤵
        Kills process with taskkill
        
        PID:1620
    - - C:\Windows\SysWOW64\net.exe
        
        net start AdskLicensingService
        5⤵
        
        PID:1968
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start AdskLicensingService
        6⤵
        
        PID:1152
    - - C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe
        
        lmgrd.exe -z -c License.lic
        5⤵
        Executes dropped EXE
        
        PID:636
      - C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exe
        
        adskflex.exe -T Gfbfpsxa 11.18 -1 -c ";License.lic;" -lmgrd_port 6978 -srv dPeX6SzbchOp1ytkqbuvjWIMWdwItHwcIRMHwyAewG13Tyg2QdT5MLkUHV5TV0H --lmgrd_start 6116394f -vdrestart 0
        6⤵
        Executes dropped EXE
        
        PID:2292
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:2956

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4028-172-0x0000000007590000-0x0000000007591000-memory.dmp

Filesize
4KB

Download
memory/4028-173-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/4028-167-0x0000000006A50000-0x0000000006A51000-memory.dmp

Filesize
4KB

Download
memory/4028-165-0x0000000004150000-0x0000000004151000-memory.dmp

Filesize
4KB

Download
memory/4028-168-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Filesize
4KB

Download
memory/4028-170-0x0000000007340000-0x0000000007341000-memory.dmp

Filesize
4KB

Download
memory/4028-183-0x00000000091F0000-0x00000000091F1000-memory.dmp

Filesize
4KB

Download
memory/4028-171-0x0000000004612000-0x0000000004613000-memory.dmp

Filesize
4KB

Download
memory/4028-169-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/4028-182-0x0000000008B70000-0x0000000008B71000-memory.dmp

Filesize
4KB

Download
memory/4028-166-0x0000000006D10000-0x0000000006D11000-memory.dmp

Filesize
4KB

Download
memory/4028-174-0x0000000007920000-0x0000000007921000-memory.dmp

Filesize
4KB

Download
memory/4028-175-0x0000000007C40000-0x0000000007C41000-memory.dmp

Filesize
4KB

Download
memory/4028-192-0x0000000004613000-0x0000000004614000-memory.dmp

Filesize
4KB

Download
memory/4028-180-0x0000000008C10000-0x0000000008C11000-memory.dmp

Filesize
4KB

Download
memory/4028-189-0x0000000009D70000-0x0000000009D71000-memory.dmp

Filesize
4KB

Download
memory/4028-181-0x0000000008900000-0x0000000008901000-memory.dmp

Filesize
4KB

Download