Process
makecab.exe
makecab.exe compresses files into Windows cabinet (.cab) archives. It is used in packaging and servicing. Attackers use it to compress data for exfiltration, shrinking and bundling collected files before sending them out.
File identity
Not observed.
Not observed.
Not observed.
Not observed.
Execution context
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cabADS · Hide data compressed into an alternate data streammakecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cabADS · Hide data compressed into an alternate data streammakecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}Download · Download file and compress into a cab filemakecab /F {PATH:.ddf}Execute · Bypass command-line based detections
Indicators
Not observed.
Analysis
makecab.exe packs one or more files into a .cab cabinet archive, optionally driven by a directive file for multi-file cabinets. It is the counterpart to expand.exe. The genuine binary lives at C:\Windows\System32\makecab.exe.
Legitimately, makecab is used by installers, servicing, and log-packaging routines. What it is compressing, and where the archive goes, are what give an instance meaning.
makecab.exe is used to archive data before exfiltration (T1560.001). Compressing collected files into a .cab makes them smaller and bundles them into one object that is easier to move, a common step between staging data and sending it out. A makecab run over documents or gathered files, producing an archive in a staging directory that subsequently leaves the host, fits the collect-archive-exfiltrate pattern.
Because makecab has legitimate packaging uses, what it compresses and where the archive ends up are what matter. Bundling user data under a script host, then transferring the result, separates exfiltration prep from ordinary packaging.
- Image path other than
C:\Windows\System32\makecab.exehigh - An archive written to a staging path that is then sent over the networkhigh
- Archiving documents or collected data from user directoriesmed
- Parent is a script host or an unfamiliar process rather than an installermed
Telemetry
Not observed.
Not observed.