LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

cmdl32.exe

View source

Microsoft Connection Manager Auto-Download

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Download a file from the web address specified in the configuration file. The downloaded file will be in %TMP% under the name VPNXXXX.tmp where "X" denotes a random number or letter.

COMMAND
cmdl32 /vpn /lan %cd%\config
USE CASE
Download file from Internet
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\cmdl32.exe
C:\Windows\SysWOW64\cmdl32.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Reports of downloading from suspicious URLs in %TMP%\config.log

  • IOC

    Useragent Microsoft(R) Connection Manager Vpn File Update

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Elliot Killick@elliotkillick