.. /Extrac32.exe
Star

Alternate data streams (Compression)
Download
Copy

Extract to ADS, copy or overwrite a file with Extrac32.exe

Paths:

Resources:

Acknowledgements:

Detections:

Alternate data streams

  1. Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.

    extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
    Use case
    Extract data from cab file and hide it in an alternate data stream.
    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004
    Tags
    Type: Compression

  2. Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.

    extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe
    Use case
    Extract data from cab file and hide it in an alternate data stream.
    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004
    Tags
    Type: Compression

Download

  1. Copy the source file to the destination file and overwrite it.

    extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}
    Use case
    Download file from UNC/WEBDav
    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1105

Copy

  1. Command for copying file from one folder to another

    extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}
    Use case
    Copy file
    Privileges required
    User
    Operating systems
    Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1105