MITRE ATT&CKsoftware (tool)

S0361 Expand

Published 2019-02-19 Modified 2025-04-25 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.1
Created: 2019-02-19

Description

Expand is a Windows utility used to expand one or more compressed CAB files. It has been used by BBSRAT to decompress a CAB file into executable content.

Uses · MITRE ATT&CK (3)

T1564.004 NTFS File Attributes sub-technique
T1570 Lateral Tool Transfer technique
T1140 Deobfuscate/Decode Files or Information technique

References

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand Microsoft Expand Utility
http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/ Palo Alto Networks BBSRAT

S0361 Expand

Description

Related

Uses · MITRE ATT&CK (3)

References