cmdl32.exe
- File Path:
C:\WINDOWS\SysWOW64\cmdl32.exe - Description: Microsoft Connection Manager Auto-Download
Hashes
| Type | Hash |
|---|---|
| MD5 | CD38B65FBFF35E1D3E307DD70F1D2E99 |
| SHA1 | 76BACAE59C84BAE5323E6B3404DD9C53F7AB2D36 |
| SHA256 | 842EEE57AEC0D8FF489079EB086B091AF253B10F74E9CF344CF0DAEB6A838946 |
| SHA384 | 4EA84B23958E2713833F669C184CEB8E76382D3B0305D03C3DCA2550A535F6503C1A05C5332EBDBD90F135601DF7C720 |
| SHA512 | 5E25A86BEBA0C1DF92AD72672DADDCE4084397E72A93D3503DE81F31828E62569504B9FF80623189D695742F9BF3B35BEE84A3F058E58E913169CA3032E655F8 |
| SSDEEP | 768:KTqHPEiucKtfeXiBWts4v5s5OI5r5kP7Jtj7Zq26JCOcdsnIbcC:KT+PEJcKtfeyq0TknjLSnIbZ |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266 - Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: CMDL32.EXE.MUI
- Product Name: Microsoft(R) Connection Manager
- Company Name: Microsoft Corporation
- File Version: 7.2.18362.1 (WinBuild.160101.0800)
- Product Version: 7.2.18362.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
File Similarity (ssdeep match)
| File | Score |
|---|---|
| C:\windows\SysWOW64\cmdl32.exe | 33 |
| C:\Windows\SysWOW64\cmdl32.exe | 44 |
| C:\Windows\SysWOW64\cmdl32.exe | 43 |
| C:\Windows\SysWOW64\cmdl32.exe | 50 |
Possible Misuse
The following table contains possible examples of cmdl32.exe being misused. While cmdl32.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | proc_creation_win_susp_cmdl32_lolbas.yml | title: Suspicious Cmdl32 Execution |
DRL 1.0 |
| sigma | proc_creation_win_susp_cmdl32_lolbas.yml | description: lolbas Cmdl32 is use to download a payload to evade antivirus |
DRL 1.0 |
| sigma | proc_creation_win_susp_cmdl32_lolbas.yml | - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/ |
DRL 1.0 |
| sigma | proc_creation_win_susp_cmdl32_lolbas.yml | cmdl32: |
DRL 1.0 |
| sigma | proc_creation_win_susp_cmdl32_lolbas.yml | - Image\|endswith: '\cmdl32.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_cmdl32_lolbas.yml | - OriginalFileName: CMDL32.EXE |
DRL 1.0 |
| sigma | proc_creation_win_susp_cmdl32_lolbas.yml | condition: cmdl32 and options |
DRL 1.0 |
| LOLBAS | Cmdl32.yml | Name: cmdl32.exe |
|
| LOLBAS | Cmdl32.yml | - Command: cmdl32 /vpn /lan %cd%\config |
|
| LOLBAS | Cmdl32.yml | - Path: C:\Windows\System32\cmdl32.exe |
|
| LOLBAS | Cmdl32.yml | - Path: C:\Windows\SysWOW64\cmdl32.exe |
|
| atomic-red-team | T1105.md | Uses the cmdl32 to download arbitrary file from the internet. The cmdl32 package is allowed to install the profile used to launch the VPN connection. However, the config is modified to download the arbitary file. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | The issue of cmdl32.exe detecting and deleting the payload by identifying it as not a VPN Servers profile is avoided by setting a temporary TMP folder and denying the delete permission to all files for the user. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/ | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | https://strontic.github.io/xcyclopedia/library/cmdl32.exe-FA1D5B8802FFF4A85B6F52A52C871BBB.html | MIT License. © 2018 Red Canary |
MIT License. Copyright (c) 2020-2021 Strontic.