windows enabled community medium v1.0.0

extrac32

Extract to ADS, copy or overwrite a file with Extrac32.exe Located at: C:\Windows\System32\extrac32.exe; C:\Windows\SysWOW64\extrac32.exe.

📋 Live Preview 
extrac32
extrac32

Sandbox: execFile · Timeout: 30s

Capabilities

system.file.alternate-data-stream
network.transfer.download
system.file.copy

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_writenetwork_traffic

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networkmedium
Disk I/Olow

Examples

Extracts the source CAB file into an Alternate Data Stream (ADS) of the target file. (Extract data from cab file and hide it in an alternate data stream.)

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file. (Extract data from cab file and hide it in an alternate data stream.)

extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exe

Copy the source file to the destination file and overwrite it. (Download file from UNC/WEBDav)

extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}

Command for copying file from one folder to another (Copy file)

extrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}

Detection

TypeRule / Indicator
elastic https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml

Documentation

extrac32

extrac32 is a Windows LOLBin. Extract to ADS, copy or overwrite a file with Extrac32.exe Located at: C:\Windows\System32\extrac32.exe; C:\Windows\SysWOW64\extrac32.exe.

References