Техническая информация
Для обеспечения автозапуска и распространения
Создает или изменяет следующие файлы
- <SYSTEM32>\tasks\microsoft\windows\autodesk\autodesk
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\net.exe' stop AdskLicensingService
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingService.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingAgent.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "ADPClientService.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingAnalyticsClient.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "AdskLicensingInstHelper.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "lmgrd.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "adskflex.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "lmutil.exe"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM "lmtools.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\adskflex.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AutodeskNLM" dir=in action=block profile=any program="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\adskflex.exe"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="AutodeskNLM" dir=out action=block profile=any program="%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\lmgrd.exe"
Изменения в файловой системе
Создает следующие файлы
- C:\autodesklicensepatcherinstaller\files\service\service.bat
- C:\autodesklicensepatcherinstaller\files\service\service.vbs
- C:\autodesklicensepatcherinstaller\files\task\autodesk.xml
- C:\autodesklicensepatcherinstaller\autodesklicensepatcherinstaller.bat
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\license.lic
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\lmgrd.exe
- C:\autodesklicensepatcherinstaller\files\patchedfiles\version.dll
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\adskflex.exe
- nul
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\adskflex.exe
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\lmgrd.exe
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\license.lic
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\service.vbs
- %CommonProgramFiles(x86)%\autodesk shared\network license manager\service.bat
- %CommonProgramFiles(x86)%\autodesk shared\adsklicensing\current\adsklicensingagent\version.dll
Удаляет следующие файлы
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\adskflex.exe
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\license.lic
- C:\autodesklicensepatcherinstaller\files\networklicensemanager\lmgrd.exe
- C:\autodesklicensepatcherinstaller\files\patchedfiles\version.dll
- C:\autodesklicensepatcherinstaller\files\service\service.bat
- C:\autodesklicensepatcherinstaller\files\service\service.vbs
- C:\autodesklicensepatcherinstaller\files\task\autodesk.xml
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
Создает и запускает на исполнение
- '%CommonProgramFiles(x86)%\autodesk shared\network license manager\lmgrd.exe' -z -c License.lic
- '%WINDIR%\syswow64\cmd.exe' /c ""%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\Service.bat" "' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\AutodeskLicensePatcherInstaller\AutodeskLicensePatcherInstaller.bat" "
- '%WINDIR%\syswow64\wscript.exe' "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\Service.vbs" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\Service.bat"
- '%WINDIR%\syswow64\net1.exe' start AdskLicensingService
- '%WINDIR%\syswow64\net.exe' start AdskLicensingService
- '%WINDIR%\syswow64\schtasks.exe' /Create /XML C:\AutodeskLicensePatcherInstaller\Files\Task\Autodesk.xml /tn "\Microsoft\Windows\Autodesk\Autodesk"
- '%WINDIR%\syswow64\schtasks.exe' /Delete /tn "\Microsoft\Windows\Autodesk\Autodesk" /f
- '%WINDIR%\syswow64\sc.exe' config AdskLicensingService Start=Auto
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "(gc License.lic) -replace 'MAC', '30D14FB5B808 ' -replace 'HOSTNAME', 'oejjml' | Out-File -encoding ASCII License.lic"
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '%WINDIR%\syswow64\cmd.exe' /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%PCI%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '%WINDIR%\syswow64\cmd.exe' /c wmic path Win32_NetworkAdapter where "PNPDeviceID like '%%USB%%' AND AdapterTypeID='0'" get MacAddress,AdapterType
- '%WINDIR%\syswow64\hostname.exe'
- '%WINDIR%\syswow64\cmd.exe' /c hostname
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Rename-Computer -NewName "Administrator"
- '%WINDIR%\syswow64\cmd.exe' /c ""%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\Service.bat" "
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v RegisteredOrganization /d Administrator /f
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\PatchedFiles\version.dll" "%CommonProgramFiles(x86)%\Autodesk Shared\AdskLicensing\Current\AdskLicensingAgent\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\Service\Service.bat" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\Service\Service.vbs" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\License.lic" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\lmgrd.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\xcopy.exe' "C:\AutodeskLicensePatcherInstaller\Files\NetworkLicenseManager\adskflex.exe" "%CommonProgramFiles(x86)%\Autodesk Shared\Network License Manager\" /Y /K /R /S /H /i
- '%WINDIR%\syswow64\msiexec.exe' /X {4BE91685-1632-47FC-B563-A8A542C6664C} /qn
- '%WINDIR%\syswow64\net1.exe' stop AdskLicensingService
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 5
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 15
- '%WINDIR%\syswow64\fltmc.exe'
- '%WINDIR%\syswow64\reg.exe' add hkcu\software\classes\.Admin\shell\runas\command /f /ve /d "cmd /x /d /r set \"f0=%2\" &call \"%2\" %3"
- '%WINDIR%\syswow64\mode.com' con: cols=70 lines=15
- '%WINDIR%\syswow64\chcp.com' 1254
- '%WINDIR%\syswow64\reg.exe' Add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v RegisteredOwner /d Administrator /f
- '%WINDIR%\syswow64\mode.com' con: cols=70 lines=12
