Microsoft Connection Manager Auto-Download Located at: C:\Windows\System32\cmdl32.exe; C:\Windows\SysWOW64\cmdl32.exe.
cmdl32cmdl32Sandbox: execFile · Timeout: 30s
network.transfer.download Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Download a file from the web address specified in the configuration file. The downloaded file will be in %TMP% under the name VPNXXXX.tmp where "X" denotes a random number or letter. (Download file from Internet)
cmdl32 /vpn /lan %cd%\config| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_cmdl32.yml |
| ioc | Reports of downloading from suspicious URLs in %TMP%\config.log |
| ioc | Useragent Microsoft(R) Connection Manager Vpn File Update |
cmdl32 is a Windows LOLBin. Microsoft Connection Manager Auto-Download Located at: C:\Windows\System32\cmdl32.exe; C:\Windows\SysWOW64\cmdl32.exe.