Catalog LOLBAS

LOL · OtherMSBinary

Dxcap.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Launch specified executable as a subprocess of dxcap.exe. Note that you should have write permissions in the current working directory for the command to succeed; alternatively, add '-file c:\path\to\writable\location.ext' as first argument.

Use Local execution of a process as a subprocess of dxcap.exe

Dxcap.exe -c {PATH_ABSOLUTE:.exe}
Context
user
Native
Execute
MITRE
T1127
Detection
IOC: dxcap.exe executing from outside of System32/SysWOW64
IOC: dxcap.exe spawning Xperf.exe
IOC: Xperf.exe executing from unusual directories (if not running from ADK path)

Execute

Execution Windows

Once executed, `dxcap.exe` will execute `xperf.exe` in the same folder. Thus, if `dxcap.exe` is copied to a folder and an arbitrary executable is renamed to `xperf.exe`, `dxcap.exe` will spawn it.

Use Execute an arbitrary executable via trusted system executable.

dxcap.exe -usage
Context
user
Native
Execute
MITRE
T1127
Detection
IOC: dxcap.exe executing from outside of System32/SysWOW64
IOC: dxcap.exe spawning Xperf.exe
IOC: Xperf.exe executing from unusual directories (if not running from ADK path)