| File name: | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe |
| Full analysis: | https://app.any.run/tasks/84ca7dc5-07d2-4073-9154-1164859e80ed |
| Verdict: | Malicious activity |
| Analysis date: | August 26, 2024, 15:25:06 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | F63978E7F953AA12B33E486A3C15D4E9 |
| SHA1: | 412385D5FCED547129E6B97BA3E6C846671099B0 |
| SHA256: | CB8C1C418FCC215DA84C96AAB6D09883C9C8131DFEB0C5F1338BC18F9F03D76C |
| SSDEEP: | 98304:8oTVX7YRehHRyZrGymzW3ABCXJUZ7+Kuun+Rn9LhW9k/sQMvD8wIyqz9H1UKVltd:J890p0dJ4BvhBQTOehb5Ytd3zaLCHC |
MALICIOUS
No malicious indicators.SUSPICIOUS
Process drops legitimate windows executable
- Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe (PID: 5160)
Executable content was dropped or overwritten
- Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe (PID: 5160)
Drops the executable file immediately after the start
- Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe (PID: 5160)
The process drops C-runtime libraries
- Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe (PID: 5160)
Drops 7-zip archiver for unpacking
- Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe (PID: 5160)
Reads security settings of Internet Explorer
- Setup.exe (PID: 5556)
Checks Windows Trust Settings
- Setup.exe (PID: 5556)
INFO
Checks supported languages
- Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe (PID: 5160)
- Setup.exe (PID: 5556)
- DownloadManager.exe (PID: 3584)
- DownloadManager.exe (PID: 7080)
Creates files or folders in the user directory
- Setup.exe (PID: 5556)
- DownloadManager.exe (PID: 3584)
Create files in a temporary directory
- Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe (PID: 5160)
- Setup.exe (PID: 5556)
- DownloadManager.exe (PID: 3584)
- DownloadManager.exe (PID: 7080)
Reads the computer name
- Setup.exe (PID: 5556)
- DownloadManager.exe (PID: 3584)
- DownloadManager.exe (PID: 7080)
Reads the machine GUID from the registry
- Setup.exe (PID: 5556)
Checks proxy server information
- Setup.exe (PID: 5556)
- DownloadManager.exe (PID: 3584)
- DownloadManager.exe (PID: 7080)
Reads the software policy settings
- Setup.exe (PID: 5556)
Creates files in the program directory
- Setup.exe (PID: 5556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:02:21 17:00:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 28160 |
| InitializedDataSize: | 558592 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x7b64 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Autodesk, Inc. |
| FileDescription: | Autodesk Installation Services |
| FileVersion: | 1.0.0.0 |
| InternalName: | ODIS Bootstrap |
| LegalCopyright: | © Autodesk 2019 |
| OriginalFileName: | Setup.exe |
| ProductName: | Autodesk Installation Services |
| ProductVersion: | 1.0.0.0 |
Total processes
130
Monitored processes
7
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2580 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | DownloadManager.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3352 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | DownloadManager.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3584 | "C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\DownloadManager.exe" -u "https://efulfillment.autodesk.com/NetSWDLD/ODIS/prd/2025/PLC0000037/984E9F0B-8BB2-3CE8-BCF5-2D3899919001/WI/Autodesk_DWG_TrueView_2025_en-US_setup.dat" -p "C:\Users\admin\AppData\Local\Temp\odis_download_dest\2236788610448611187\Autodesk_DWG_TrueView_2025_en-US_setup.dat" --productname Bootstrap --productversion 2.7.0.1 | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\DownloadManager.exe | Setup.exe | ||||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: HIGH Description: Autodesk Desktop Delivery Application Exit code: 0 Version: 2.7.0.1 Modules
| |||||||||||||||
| 4680 | "C:\Users\admin\AppData\Local\Temp\Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe" | C:\Users\admin\AppData\Local\Temp\Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | — | explorer.exe | |||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: MEDIUM Description: Autodesk Installation Services Exit code: 3221226540 Version: 1.0.0.0 Modules
| |||||||||||||||
| 5160 | "C:\Users\admin\AppData\Local\Temp\Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe" | C:\Users\admin\AppData\Local\Temp\Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | explorer.exe | ||||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: HIGH Description: Autodesk Installation Services Version: 1.0.0.0 Modules
| |||||||||||||||
| 5556 | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\Setup.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\Setup.exe | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | ||||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: HIGH Version: 2.7.0.1 Modules
| |||||||||||||||
| 7080 | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\DownloadManager.exe -u https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ODIS/EA5ACC81-82CF-339D-9431-6421559B3772/pkg.odis.tar -p C:\Users\admin\AppData\Local\Temp\odis_download_dest\EA5ACC81-82CF-339D-9431-6421559B3772\pkg.odis.tar --productname BootStrap --productversion 2.7.0.1 --fileChecksum 3EAB4C30DF5478D91B61695E7D6FC79A07A268A674A14A021A89AE408E9FD96E | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\DownloadManager.exe | Setup.exe | ||||||||||||
User: admin Company: Autodesk, Inc. Integrity Level: HIGH Description: Autodesk Desktop Delivery Application Version: 2.7.0.1 Modules
| |||||||||||||||
Total events
5 536
Read events
5 531
Write events
5
Delete events
0
Modification events
| (PID) Process: | (3584) DownloadManager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Autodesk\DDA\DLM\CER\2.7.0.1 |
| Operation: | write | Name: | SessionStartCount |
Value: 1 | |||
| (PID) Process: | (3584) DownloadManager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Autodesk\DDA\DLM\CER\2.7.0.1 |
| Operation: | write | Name: | SessionCleanCloseCount |
Value: 1 | |||
| (PID) Process: | (3584) DownloadManager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Autodesk\DDA\DLM\CER\2.7.0.1 |
| Operation: | write | Name: | Uptime |
Value: C2EB0B0000000000 | |||
| (PID) Process: | (3584) DownloadManager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Autodesk\DDA\DLM\CER\2.7.0.1 |
| Operation: | write | Name: | CalUptime |
Value: 1647CF0000000000 | |||
| (PID) Process: | (7080) DownloadManager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Autodesk\DDA\DLM\CER\2.7.0.1 |
| Operation: | write | Name: | SessionStartCount |
Value: 2 | |||
Executable files
35
Suspicious files
19
Text files
28
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\Autodesk_dialog_512x512.png | image | |
MD5:36DF17F969396609A4C3B2FDA06C3D76 | SHA256:BFF55FCAF87784D76ACF68F10B9D0A13DA938BA2EADEB8A8482FC0A28E618237 | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\CER\upiconfig.xml | text | |
MD5:13BD414E2B99622217C99594129591CA | SHA256:D07AF64657E44140C0FAF99FA552FE60399E178F84B150297B568407B434B3C2 | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\odis.bs.win\odis.bs.win.manifest | text | |
MD5:B131428CEA917BB73CE4DEE4CB5B658D | SHA256:764D9D37DE8E4DE01A4007F563DC8B0D03989A39F9DFE42090652026AA195AC3 | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\strings.xml | xml | |
MD5:B89A99DB79F644A690721C11A1274958 | SHA256:AE652E226F0D983D0445178DCF8152265426460CABD6CFE49F7D5D9966C24A9B | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\CER\senddmp.exe.config | xml | |
MD5:C64632957C9A46B320E412D857E176C0 | SHA256:16A5B2D1D7CC9914BCE73914D4D956D3BA7A2EC34E3D41E876F2E265C15D8096 | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\CER\cs-CZ\senddmp.resources.dll | executable | |
MD5:92C693BF3C3104AF71FEA1C17CF24A99 | SHA256:521BB3C166BA537DBFBF8E112248D024809B823646AC8FDBC41943FF6AEF0074 | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\7z-license.txt | text | |
MD5:D99AA46C2205B66C776292A2BCF7F366 | SHA256:EFE357154875B80E6FC3787E7C83C6F368BD6EF4C25A872D59801C8E137CFE32 | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\Setup.exe.config | text | |
MD5:B16AB9F79AAF24A7300993C0518BA9BB | SHA256:2C4F7A24C50CBE05E40066E3BD3686A0F05117C870865D08E72638DC70835FC7 | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\ODIS\CER\cer_core.dll | executable | |
MD5:B22B3B2395B7ADD33D6262DA690D7153 | SHA256:75E30B2F1AA8A6537F2FFC4B2F986A4A019E40E3AF6E8F94FBBCF19B41F2B14E | |||
| 5160 | Autodesk_DWG_TrueView_2025_en-US_setup_webinstall.exe | C:\Users\admin\AppData\Local\Temp\7z2FB7D428\SetupRes\add.logconfig | text | |
MD5:7277BAD79C54DD9AEF4588A1DCF6DD5E | SHA256:1A584768CE704C99529F839EE4B7911F181D47CA5082DAD7CB5F8322EFBD619E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
36
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5556 | Setup.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D | unknown | — | — | whitelisted |
5556 | Setup.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D | unknown | — | — | whitelisted |
5556 | Setup.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAMAeNEyEUtosA1ynBJKgZI%3D | unknown | — | — | whitelisted |
608 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
608 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4164 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6428 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
6412 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5556 | Setup.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3584 | DownloadManager.exe | 23.52.181.114:443 | efulfillment.autodesk.com | Akamai International B.V. | US | whitelisted |
6428 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5556 | Setup.exe | 34.201.246.234:443 | manifest.delivery.autodesk.com | AMAZON-AES | US | whitelisted |
7080 | DownloadManager.exe | 23.32.101.119:443 | dds.autodesk.com | AKAMAI-AS | SE | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
efulfillment.autodesk.com |
| whitelisted |
manifest.delivery.autodesk.com |
| whitelisted |
dds.autodesk.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |