makecab.exe

File Path: C:\windows\system32\makecab.exe
Description: Microsoft Cabinet Maker

Hashes

Type	Hash
MD5	`5DAB3A3EC2A253CEB5FF4135ED5F571C`
SHA1	`08E5E24A4FCE1D05C3E629CB8C4C7E1C61884B8F`
SHA256	`6992E53AB2D927D6131142E328BA5D6D985C2A7EB64DC5CEA4D8980DCF03E768`
SHA384	`5756832EC776B03FFEE791E09FB688A95D122E83F172662E8D6A1A70B58770A8349AD5D0B56E5D7971210968E9C760F2`
SHA512	`8085229465FB12D2D45206257B681BAA9BD9886FA3FDFBAE248C94AF792DBD2EBCCD2D34A341E89BE57450E1D094DBB5C77AAB374C725F56D2970EAD0750D15F`
SSDEEP	`1536:i3EDOH/oHMHRU/DH8C2HeubcbFBWUcFq3pIHJsd/LGxSXz:MEDQwH8RU/DHm+mcbFBWUj3pIpaLGx0`

Signature

Status: The file C:\windows\system32\makecab.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
Serial: ``
Thumbprint: ``
Issuer:
Subject:

File Metadata

Original Filename: makecab.exe
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 6.3.9600.17415 (winblue_r4.141028-1500)
Product Version: 6.3.9600.17415
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of makecab.exe being misused. While makecab.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	sysmon_suspicious_remote_thread.yml	`- '\makecab.exe'`	DRL 1.0
sigma	proc_creation_win_alternate_data_streams.yml	`- 'makecab '`	DRL 1.0
sigma	proc_creation_win_apt_hafnium.yml	`Image\\|endswith: '\makecab.exe'`	DRL 1.0
LOLBAS	Makecab.yml	`Name: Makecab.exe`
LOLBAS	Makecab.yml	`- Command: makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab`
LOLBAS	Makecab.yml	`- Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab`
LOLBAS	Makecab.yml	`- Command: makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab`
LOLBAS	Makecab.yml	`- Path: C:\Windows\System32\makecab.exe`
LOLBAS	Makecab.yml	`- Path: C:\Windows\SysWOW64\makecab.exe`
LOLBAS	Makecab.yml	`- IOC: Makecab retrieving files from Internet`
LOLBAS	Makecab.yml	`- IOC: Makecab storing data into alternate data streams`
atomic-red-team	T1564.004.md	makecab #{path}\autoruns.exe #{path}\cabtest.txt:autoruns.cab	MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

makecab

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Package existing files into a cabinet (.cab) file.

[!NOTE] This command is the same as the diantz command.

Syntax

makecab [/v[n]] [/d var=<value> ...] [/l <dir>] <source> [<destination>]
makecab [/v[<n>]] [/d var=<value> ...] /f <directives_file> [...]

Parameters

Parameter	Description
`<source>`	File to compress.
`<destination>`	File name to give compressed file. If omitted, the last character of the source file name is replaced with an underscore (_) and used as the destination.
/f `<directives_file>`	A file with makecab directives (may be repeated).
/d var=`<value>`	Defines variable with specified value.
/l `<dir>`	Location to place destination (default is current directory).
/v[`<n>`]	Set debugging verbosity level (0=none,…,3=full).
/?	Displays help at the command prompt.