CatalogLOLBAS

LOL · Binary

Makecab.exe

4 techniquesWindowsLOLBASGPL-3.0

ADS

Defense EvasionFile WriteWindows

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

Use Hide data compressed into an alternate data stream

makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab
Evidence
Upstream reference
Environment
Local host
Context
user
Native
ADS

ADS

Defense EvasionFile WriteWindows

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

Use Hide data compressed into an alternate data stream

makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cab
Evidence
Upstream reference
Environment
Local host
Context
user
Native
ADS

Download

File DownloadWindows

Download and compresses the target file and stores it in the target file.

Use Download file and compress into a cab file

makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Download
MITRE
T1105

Execute

ExecutionWindows

Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.

Use Bypass command-line based detections

makecab /F {PATH:.ddf}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1036