Process
extrac32.exe
extrac32.exe extracts files from Windows cabinet (.cab) archives and can copy files. Like expand, it has a legitimate servicing role. Attackers use it to copy files, including across remote shares, through a signed binary for ingress and staging.
File identity
Not observed.
Not observed.
Not observed.
Not observed.
Execution context
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exeADS · Extract data from cab file and hide it in an alternate data stream.extrac32 {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE}:file.exeADS · Extract data from cab file and hide it in an alternate data stream.extrac32 /Y /C {PATH_SMB} {PATH_ABSOLUTE}Download · Download file from UNC/WEBDavextrac32.exe /C {PATH_ABSOLUTE:.source.exe} {PATH_ABSOLUTE:.dest.exe}Copy · Copy file
Indicators
Not observed.
Analysis
extrac32.exe unpacks .cab cabinet archives and can also copy a plain file from one location to another with the /c option. Source and destination can be UNC paths, so it reads and writes over the network. The genuine binary lives at C:\Windows\System32\extrac32.exe.
Legitimately, extrac32 is used in servicing and installer scenarios that handle cabinet files, which is uncommon interactively. The source and destination it operates on are what give an instance meaning.
extrac32.exe is an ingress and staging tool (T1105). Its file-copy ability, including across UNC paths, lets an attacker pull a file onto the host or stage one through a trusted, signed binary, the same role as expand.exe. A copy from a remote share, or a payload-looking file landing in a user-writable directory, is what gives it away.
Because extrac32 has a real servicing purpose, the source and destination are what matter. A remote source or a suspicious destination under an unusual parent separates abuse from legitimate cabinet handling.
- Image path other than
C:\Windows\System32\extrac32.exehigh /ccopying from or to a remote (\\host\share) pathhigh- Writing an executable or script into a user-writable pathhigh
- Parent is an Office application, a script host, or an unfamiliar processhigh
Telemetry
Not observed.
Not observed.