Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop AdskLicensingService
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingService.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingAgent.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "ADPClientService.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingAnalyticsClient.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingInstHelper.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "lmgrd.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "adskflex.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "lmutil.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "lmtools.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\adskflex.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\adskflex.exe"
Modifies file system
Creates the following files
- C:\autodesklicensepatcherinstaller\files\task\autodesk.xml
- %WINDIR%\temp\tar55f4.tmp
- %WINDIR%\temp\cab55f3.tmp
- %WINDIR%\temp\tar3fe2.tmp
- %WINDIR%\temp\cab3fe1.tmp
- %WINDIR%\temp\tarb703.tmp
- %WINDIR%\temp\cabb702.tmp
- nul
- %WINDIR%\temp\cab6b68.tmp
- C:\autodesklicensepatcherinstaller\files\patchedfiles\version.dll
- C:\autodesklicensepatcherinstaller\files\patchedfiles\netapi32.dll
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\lmgrd.exe
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\adskflex.exe
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\license.lic
- C:\autodesklicensepatcherinstaller\autodesklicensepatcherinstaller.bat
- C:\autodesklicensepatcherinstaller\files\tweak\tweak.reg
- C:\autodesklicensepatcherinstaller\files\tweak\unnamed.json
- C:\autodesklicensepatcherinstaller\files\service\service.exe
- %WINDIR%\temp\tar6b69.tmp
Deletes the following files
- %WINDIR%\temp\cabb702.tmp
- %WINDIR%\temp\tarb703.tmp
- %WINDIR%\temp\cab3fe1.tmp
- %WINDIR%\temp\tar3fe2.tmp
- %WINDIR%\temp\cab55f3.tmp
- %WINDIR%\temp\tar55f4.tmp
- %WINDIR%\temp\cab6b68.tmp
- %WINDIR%\temp\tar6b69.tmp
Network activity
Connects to
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt
UDP
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\AutodeskLicensePatcherInstaller\AutodeskLicensePatcherInstaller.bat" "
- '%WINDIR%\syswow64\sc.exe' config "AdskLicensingService" Start= Auto
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "(gc License.lic) -replace 'MAC', ' ' | Out-File -encoding ASCII License.lic"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -noprofile -executionpolicy bypass -command "((Get-NetAdapter -Physical | ? PnPDeviceID -match '^PCI|^USB' | Sort PnPDeviceID -Descending).MacAddress | Select -Last 1) -replace '-'"
- '%WINDIR%\syswow64\cmd.exe' /c Powershell -noprofile -executionpolicy bypass -command "((Get-NetAdapter -Physical | ? PnPDeviceID -match '^PCI|^USB' | Sort PnPDeviceID -Descending).MacAddress | Select -Last 1) -replace '-...
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\Tweak\UnNamed.json" "%APPDATA%\Autodesk\ADPSDK\UserConsent\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\netapi32.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\Adlm\R28\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\netapi32.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\Service\Service.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\License.lic" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\lmgrd.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\regedit.exe' /s "C:\AutodeskLicensePatcherInstaller\Files\Tweak\Tweak.reg"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -nop -c "Get-WmiObject -Query ' select * from Win32_Product where Name like \"%Autodesk Network License Manager%\" ' | ForEach-Object { ($_).Uninstall()}"
- '%WINDIR%\syswow64\net1.exe' stop AdskLicensingService
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 5
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 15
- '%WINDIR%\syswow64\fltmc.exe'
- '%WINDIR%\syswow64\reg.exe' add hkcu\software\classes\.Admin\shell\runas\command /f /ve /d "cmd /x /d /r set \"f0=%2\" &call \"%2\" %3"
- '%WINDIR%\syswow64\mode.com' con: cols=70 lines=15
- '%WINDIR%\syswow64\chcp.com' 1254
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn "\Microsoft\Windows\Autodesk\Autodesk" /f
- '%WINDIR%\syswow64\schtasks.exe' /Create /XML C:\AutodeskLicensePatcherInstaller\Files\Task\Autodesk.xml /tn "\Microsoft\Windows\Autodesk\Autodesk"
