Skip to content

S0361 Expand

Expand is a Windows utility used to expand one or more compressed CAB files.1 It has been used by BBSRAT to decompress a CAB file into executable content.2

Item Value
ID S0361
Associated Names
Version 1.1
Created 19 February 2019
Last Modified 20 March 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1140 Deobfuscate/Decode Files or Information Expand can be used to decompress a local or remote CAB file into an executable.1
enterprise T1564 Hide Artifacts -
enterprise T1564.004 NTFS File Attributes Expand can be used to download or copy a file into an alternate data stream.3
enterprise T1570 Lateral Tool Transfer Expand can be used to download or upload a file over a network share.3