Abuse of expand.exe for Malicious Payload Staging

APT37 has been observed utilizing the built-in Windows utility expand.exe to facilitate the deployment of malicious payloads. This technique involves the extraction of Microsoft Cabinet (CAB) files, such as 'wonder.cab', directly into staging directories like C:\ProgramData. By repurposing this native binary, the threat actor aims to evade traditional signature-based detection that often targets custom or non-standard extraction tools. This activity is a critical indicator of ingress tool transfer and the preparation phase of an attack chain, allowing for the subsequent execution of Rust-based backdoors or loaders. Defenders should monitor for command-line arguments involving the '/F:' or '-F:' flags when invoked by unexpected or suspicious parent processes.

Attack Chain

1. Attacker establishes initial access via spearphishing or exploit vector.
2. Malicious CAB archive (e.g., wonder.cab) is downloaded to a temporary directory on the victim host.
3. Attacker executes expand.exe using command-line arguments to extract all files (e.g., expand.exe -F:* [path_to_cab] C:\ProgramData).
4. Malicious payloads and secondary scripts are unpacked into the C:\ProgramData staging area.
5. Attacker executes the staged binary or script via command-line or service creation to establish persistence.
6. The primary malware (e.g., Rust-based backdoor) initiates callback to command-and-control infrastructure.
7. Attacker performs discovery or exfiltration activities based on the specific campaign objectives.

Impact

Successful exploitation allows for the covert staging and execution of secondary payloads, including backdoors and loaders, leading to potential full system compromise, data theft, and persistent monitoring of the victim environment. APT37 targeting focuses on strategic intelligence gathering and operations against various sectors, often impacting multiple organizations simultaneously during coordinated campaigns.

Recommendation

• Deploy the Sigma rule below to detect suspicious expand.exe activity targeting common staging directories.
• Enable Sysmon Event ID 1 (Process Creation) with command-line logging across all endpoints to ensure visibility into utility arguments.
• Baseline the usage of expand.exe in the environment to differentiate legitimate software update routines from unauthorized archive extraction.
• Audit C:\ProgramData and similar temp directories for anomalous file creation patterns following process creation alerts.