Expand
Expand is a Windows utility used to expand one or more compressed CAB files.[1] It has been used by BBSRAT to decompress a CAB file into executable content.[2]
ID: S0361
Type: TOOL
Contributors: Matthew Demaske, Adaptforward
Platforms: Windows
Version: 1.0
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Expand can be used to decompress a local or remote CAB file into an executable.[1] |
| Enterprise | T1096 | NTFS File Attributes | Expand can be used to download or copy a file into an alternate data stream.[3] |
| Enterprise | T1105 | Remote File Copy | Expand can be used to download or upload a file over a network share.[3] |