Replace.exe

Used to replace file with another file

Paths

  • C:\Windows\System32\replace.exe
  • C:\Windows\SysWOW64\replace.exe

Commands

Copy

Copy .cab file to destination

Use case: Copy files

Privileges: User

replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A

Download

Download/Copy executable to specified folder

Use case: Download file

Privileges: User

replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A

Detection

Resources