Expand

S0361

About this tool

Expand is a Windows utility used to expand one or more compressed CAB files. It has been used by BBSRAT to decompress a CAB file into executable content.

Techniques used3

Stealth2

Lateral Movement1

T1570Lateral Tool Transfer

Procedure examples3

Technique	Procedure example
T1140 Deobfuscate/Decode Files or Information	Expand can be used to decompress a local or remote CAB file into an executable. Microsoft Expand Utility
T1564.004 NTFS File Attributes	Expand can be used to download or copy a file into an alternate data stream. LOLBAS Expand
T1570 Lateral Tool Transfer	Expand can be used to download or upload a file over a network share. LOLBAS Expand

Groups that use it0

None recorded.

Campaigns0

None recorded.

References2

Microsoft Expand Utility Open source
Microsoft. (2017, October 15). Expand. Retrieved February 19, 2019.
Palo Alto Networks BBSRAT Open source
Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.