Change.exe

Commands

1. ExecuteUser T1218

   Execute an arbitrary executable via trusted system executable.

   change.exe user

   Once executed, change.exe will execute chgusr.exe in the same folder. Thus, if change.exe is copied to a folder and an arbitrary executable is renamed to chgusr.exe, change.exe will spawn it. Instead of user, it is also possible to use port or logon as command-line option.

   os: Windows 10, Windows 11

   Execute: EXERequires: Rename

Detection

• IOCchange.exe being executed and executes a child process outside of its normal path of c:\windows\system32\ or c:\windows\syswow64\