Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\AdskNLM] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\AdskNLM] 'ImagePath' = '"%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe"'
Creates the following services
- 'AdskNLM' %CommonProgramFiles(x86)%\Autodesk Shared�etwork License Manager\lmgrd.exe
- 'AdskNLM' %CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /im AdskLicensingAgent.exe /f
Modifies file system
Creates the following files
- %TEMP%\adsk-nlm\createlic.cmd
- %TEMP%\adsk-nlm\nlm.mst
- %TEMP%\adsk-nlm\nlm11.16.2.0_ipv4_ipv6_win64.msi
- %TEMP%\adsk-nlm\licenses.lic
- %TEMP%\adsk-nlm\version.dll
- %TEMP%\adsk-nlm\adskflex.exe
- %WINDIR%\installer\d6d32.mst
- %WINDIR%\temp\~df9ad6e81d754a0baf.tmp
- %WINDIR%\installer\sourcehash{4be91685-1632-47fc-b563-a8a542c6664c}
- %WINDIR%\temp\~df35b9101a585ce14d.tmp
- %WINDIR%\temp\~df07671461c7fcd36b.tmp
- %WINDIR%\temp\~df0c2f914538ba4a81.tmp
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\adskflex.exe
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\lmgrd.exe
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\lmtools.exe
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\lmutil.exe
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\licenseadministration.pdf
- %APPDATA%\microsoft\installer\{4be91685-1632-47fc-b563-a8a542c6664c}\lmtools.exe
- %APPDATA%\microsoft\windows\start menu\programs\autodesk\network license manager\lmtools utility.lnk
- %APPDATA%\microsoft\installer\{4be91685-1632-47fc-b563-a8a542c6664c}\nlm.mst
- %WINDIR%\temp\~dfb4a43ae3ebf1d6b8.tmp
- %WINDIR%\temp\~dfed75214f7fc64a81.tmp
- %WINDIR%\temp\~dfad2a2c2080181697.tmp
- %WINDIR%\temp\~dfb47a622894589a7a.tmp
- %WINDIR%\temp\~dfd6f3b0b11c79f7ca.tmp
- %WINDIR%\temp\~dfd59b02e2b987008c.tmp
- %WINDIR%\temp\~dfdd7e682127efd319.tmp
- %WINDIR%\temp\~dfed3e336260e10d2b.tmp
- %TEMP%\adsk-nlm\fstln.txt
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\licenses.lic
- %CommonProgramFiles(x86)%\autodesk shared\adsklicensing\current\adsklicensingagent\version.dll
Deletes following files that it created itself
- %WINDIR%\installer\d6d32.mst
- %TEMP%\adsk-nlm\adskflex.exe
- %TEMP%\adsk-nlm\createlic.cmd
- %TEMP%\adsk-nlm\fstln.txt
- %TEMP%\adsk-nlm\licenses.lic
- %TEMP%\adsk-nlm\nlm.mst
- %TEMP%\adsk-nlm\nlm11.16.2.0_ipv4_ipv6_win64.msi
- %TEMP%\adsk-nlm\version.dll
Network activity
Connects to
- '<LOCALNET>..33.9':27000
- '<LOCALNET>..33.9':27001
- '<LOCALNET>..33.9':27002
- '<LOCALNET>..33.9':27003
- '<LOCALNET>..33.9':27004
- '<LOCALNET>..33.9':27005
- '<LOCALNET>..33.9':27006
- '<LOCALNET>..33.9':27007
- '<LOCALNET>..33.9':27008
- '<LOCALNET>..33.9':27009
- 'localhost':49705
- 'localhost':27000
TCP
Other
- '<LOCALNET>..33.9':27000
- '<LOCALNET>..33.9':49704
- 'localhost':27000
- 'localhost':49707
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles(x86)%\autodesk shared\network license manager\lmgrd.exe'
- '%CommonProgramFiles(x86)%\autodesk shared\network license manager\lmgrd.exe' -c "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic" -z -s
- '%CommonProgramFiles(x86)%\autodesk shared\network license manager\adskflex.exe' -T wxrdzor 11.16 -1 -c ";%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic;" -lmgrd_port 6978 -srv A2qnPz4OfojN5VzBHysoNKwiT9W55tLa2swaa4PfGeZj43D2qjF81PJYkeFa0E0 -...
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\sc.exe' stop AdskNLM
- '<SYSTEM32>\wbem\wmic.exe' product where name="Autodesk Network License Manager" call uninstall /nointeractive
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\Adsk-NLM\nlm11.16.2.0_ipv4_ipv6_win64.msi" TRANSFORMS=nlm.mst INSTALLDIR1="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager" /qn
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /y /r "%TEMP%\Adsk-NLM\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager"
- '<SYSTEM32>\cmd.exe' /S /D /c" echo D "
- '<SYSTEM32>\xcopy.exe' /y /r "%TEMP%\Adsk-NLM\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adsk-NLM\createlic.cmd" "
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\wbem\wmic.exe' path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\cmd.exe' /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\wbem\wmic.exe' path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '<SYSTEM32>\sc.exe' stop AdskLicensingService
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /y /r "%TEMP%\Adsk-NLM\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
- '<SYSTEM32>\xcopy.exe' /y /r "%TEMP%\Adsk-NLM\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"
- '<SYSTEM32>\sc.exe' start AdskLicensingService
- '<SYSTEM32>\sc.exe' create AdskNLM binPath= "\"%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayna...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "@localhost" /f
- '<SYSTEM32>\sc.exe' start AdskNLM
- '<SYSTEM32>\sc.exe' stop AdskNLM' (with hidden window)
- '<SYSTEM32>\wbem\wmic.exe' product where name="Autodesk Network License Manager" call uninstall /nointeractive' (with hidden window)
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\Adsk-NLM\nlm11.16.2.0_ipv4_ipv6_win64.msi" TRANSFORMS=nlm.mst INSTALLDIR1="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager" /qn' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /y /r "%TEMP%\Adsk-NLM\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\Adsk-NLM\createlic.cmd" "' (with hidden window)
- '<SYSTEM32>\sc.exe' stop AdskLicensingService' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /im AdskLicensingAgent.exe /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c echo D | xcopy /y /r "%TEMP%\Adsk-NLM\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent"' (with hidden window)
- '<SYSTEM32>\sc.exe' start AdskLicensingService' (with hidden window)
- '<SYSTEM32>\sc.exe' create AdskNLM binPath= "\"%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe\"" start= auto depend= WinMgmt/+NetworkProvider obj= "NT AUTHORITY\LocalService" displayna...' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "License" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Lmgrd" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "License" /d "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\licenses.lic" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\FLEXlm License Manager\AdskNLM" /v "Service" /d "AdskNLM" /f' (with hidden window)
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\FLEXlm License Manager" /v "ADSKFLEX_LICENSE_FILE" /d "@localhost" /f' (with hidden window)
- '<SYSTEM32>\sc.exe' start AdskNLM' (with hidden window)
