.. /Replace.exe
Star

Used to replace file with another file

Paths:

C:\Windows\System32\replace.exe
C:\Windows\SysWOW64\replace.exe

Resources:

Acknowledgements:

elceef (@elceef)

Detections:

IOC: Replace.exe retrieving files from remote server
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml

Copy

Copy .cab file to destination
```
replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /A
```
Use case
Copy files

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105

Download

Download/Copy executable to specified folder
```
replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /A
```
Use case
Download file

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105