LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Tttracer.exe

View source

Used by Windows 1809 and newer to Debug Time Travel

ExecuteDump
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
03DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1127

Execute specified executable from tttracer.exe. Requires administrator privileges.

COMMAND
tttracer.exe {PATH_ABSOLUTE:.exe}
USE CASE
Spawn process using other binary
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10 1809 and newer, Windows 11
Execute · EXE

Dump1

EXAMPLE 01T1003

Dumps process using tttracer.exe. Requires administrator privileges

COMMAND
TTTracer.exe -dumpFull -attach {PID}
USE CASE
Dump process by PID
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows 10 1809 and newer, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\tttracer.exe
C:\Windows\SysWOW64\tttracer.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    Parent child relationship. Tttracer parent for executed command

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Onur Ulusoy@oulusoyum
Matt Graeber@mattifestation