windows enabled community medium v1.0.0

replace

Used to replace file with another file Located at: C:\Windows\System32\replace.exe; C:\Windows\SysWOW64\replace.exe.

📋 Live Preview 
replace
replace

Sandbox: execFile · Timeout: 30s

Capabilities

system.file.copy
network.transfer.download

Contract

Outputs

process.output

Command execution output

Side effects: filesystem_writenetwork_traffic

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networkmedium
Disk I/Olow

Examples

Copy .cab file to destination (Copy files)

replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A

Download/Copy executable to specified folder (Download file)

replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A

Detection

TypeRule / Indicator
ioc Replace.exe retrieving files from remote server
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml

Documentation

replace

replace is a Windows LOLBin. Used to replace file with another file Located at: C:\Windows\System32\replace.exe; C:\Windows\SysWOW64\replace.exe.

References