LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Ttdinject.exe

View source

Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1127

Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.

COMMAND
TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"
USE CASE
Spawn process using other binary
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10 2004 and above, Windows 11
Execute · EXE
EXAMPLE 02T1127

Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.

COMMAND
ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /launch "{PATH:.exe}"
USE CASE
Spawn process using other binary
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10 1909 and below
Execute · EXE
02 / ON DISK

Known paths

C:\Windows\System32\ttdinject.exe
C:\Windows\Syswow64\ttdinject.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources

Indicators & detection notes

  • IOC

    Parent child relationship. Ttdinject.exe parent for executed command

  • IOC

    Multiple queries made to the IFEO registry key of an untrusted executable (Ex. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\payload.exe") from the ttdinject.exe process

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe
Maxime Nadeau@m_nad0