Analysis
- user interaction
yes - max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 17:35
General
- Target AdskNLM.exe
- Size 29.1MB
- Sample260706-v55d5aes2n
- SHA256 62998d8ea862d6cdce7dca23006b423b5a32fdc4e85ae675010abb3c19279b25
Score
7/10
Malware Config
Signatures
- Creates new service(s) 2 TTPs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 3 IoCs
- Stops running service(s) 4 TTPs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 17 IoCs
- Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" stop AdskLicensingService2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop AdskLicensingService3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /im AdskLicensingAgent.exe /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /im AdskLicensingAgent.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingAgent" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingAgent" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo D "4⤵
-
-
C:\Windows\system32\xcopy.exexcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingAgent" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"4⤵
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingAnalyticsClient" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingAnalyticsClient" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo D "4⤵
-
-
C:\Windows\system32\xcopy.exexcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingAnalyticsClient" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingAnalyticsClient"4⤵
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingService" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingService" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo D "4⤵
-
-
C:\Windows\system32\xcopy.exexcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensingService" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService"4⤵
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\helper" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\helper"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo D | xcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\helper" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\helper"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo D "4⤵
-
-
C:\Windows\system32\xcopy.exexcopy /ehkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\helper" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\helper"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensing.sig" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensing.sig"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo F | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensing.sig" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensing.sig"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "4⤵
-
-
C:\Windows\system32\xcopy.exexcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\12.1.0.7121\AdskLicensing.sig" "C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensing.sig"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" start AdskLicensingService2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start AdskLicensingService3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im AdAppMgrSvc.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im AdAppMgrSvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "taskkill" /f /im AutodeskDesktopApp.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im AutodeskDesktopApp.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Program Files (x86)\Autodesk\Autodesk Desktop App\removeAdAppMgr.exe" --mode unattended3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive )3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic product where name="Autodesk Single Sign On Component" call uninstall /nointeractive4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c del /q /f "C:\Users\Admin\AppData\Local\Autodesk\Genuine Autodesk Service\id.dat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q /f "C:\Users\Admin\AppData\Local\Autodesk\Genuine Autodesk Service\id.dat"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.pit" "ProductInformation.bak"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Genuine Service" call uninstall /nointeractive )3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic product where name="Autodesk Genuine Service" call uninstall /nointeractive4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" stop AdskNLM2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop AdskNLM3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\delnowmic.ps1'" )2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c if exist "C:\Windows\System32\wbem\WMIC.exe" ( wmic product where name="Autodesk Network License Manager" call uninstall /nointeractive ) else ( powershell.exe -ExecutionPolicy ByPass -command ". 'C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\delnowmic.ps1'" )3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic product where name="Autodesk Network License Manager" call uninstall /nointeractive4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ren "C:\ProgramData\Autodesk\Adlm\ProductInformation.bak" "ProductInformation.pit"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "msiexec" /i "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11.16.2.0_ipv4_ipv6_win64.msi" TRANSFORMS=nlm.mst INSTALLDIR1="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager" /qn2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\nlm11.16.2.0_ipv4_ipv6_win64.msi" TRANSFORMS=nlm.mst INSTALLDIR1="C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager" /qn3⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo D | xcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo D "4⤵
-
-
C:\Windows\system32\xcopy.exexcopy /hkry "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\adskflex.exe" "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager"4⤵
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\createlic.cmd"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\createlic.cmd" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" create AdskNLM binPath= "\"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayname= AdskNLM2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create AdskNLM binPath= "\"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayname= AdskNLM3⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager" /v "lmtools_LM_A_DISABLE_ENV" /t "REG_DWORD" /d "1" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "@localhost" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "@localhost" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADAOptIn" /t "REG_DWORD" /d "0" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADAOptIn" /t "REG_DWORD" /d "0" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADARePrompted" /t "REG_DWORD" /d "1" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "ADARePrompted" /t "REG_DWORD" /d "1" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "reg" add "HKCU\SOFTWARE\Autodesk\MC3" /v "OverridedByHKLM" /t "REG_DWORD" /d "0" /f2⤵
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add "HKCU\SOFTWARE\Autodesk\MC3" /v "OverridedByHKLM" /t "REG_DWORD" /d "0" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "cmd" /c xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"2⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c xcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"3⤵
-
C:\Windows\system32\xcopy.exexcopy /y "C:\Users\Admin\AppData\Local\Temp\Adsk-NLM\UnNamed.json" "C:\Users\Admin\AppData\Roaming\Autodesk\ADPSDK\UserConsent"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe"C:\Users\Admin\AppData\Local\Temp\AdskNLM.exe" -sfxwaitall:0 "sc" start AdskNLM2⤵
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start AdskNLM3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A00CC824BF23B2FC37334E10D5BCD8A42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" -z22⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe"C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\lmgrd.exe" -c "C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic" -z -s2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\adskflex.exeadskflex.exe -T Tuyttrxl 11.16 -1 -c ";C:\Program Files (x86)\Common Files\Autodesk Shared\Network License Manager\licenses.lic;" -lmgrd_port 6978 -srv b7IXJ99OfAMx2UWQlKwC1I547uiiv8oHgNnjWDGh9a6zZGN7jnUrrm6oH4QFFqE --lmgrd_start 6a4be7df -vdrestart 03⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e59841e.rbs
lmtools.exe
API-MS-Win-core-xstate-l2-1-0.dll
AdSSOServices.dll
AdSkIdentitySDK.config
AdskIdentitySDK.dll
AdskLicensingAgent.exe
AdskProxyManager.dll
adlm.dll
adlmPIT.dll
adlmint.dll
adlmint_libFNP.dll
adlmutil.dll
adws.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-console-l1-2-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
browser.dll
concrt140.dll
idsdk.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
msvcp140_atomic_wait.dll
msvcp140_codecvt_ids.dll
netcom.dll
pit.dll
proxy.dll
nlm.mst
MSI875A.tmp
e59841a.msi