Expand - S0361 (ca656c25-44f1-471b-9d9f-e2a3bbb84973)

Expand is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by BBSRAT to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Lateral Tool Transfer - T1570 (bf90d72c-c00b-45e3-b3aa-68560560d4c5)	Attack Pattern	Expand - S0361 (ca656c25-44f1-471b-9d9f-e2a3bbb84973)	mitre-tool	1
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	Expand - S0361 (ca656c25-44f1-471b-9d9f-e2a3bbb84973)	mitre-tool	1
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	Expand - S0361 (ca656c25-44f1-471b-9d9f-e2a3bbb84973)	mitre-tool	1
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	2