Identifier / Programs / Windows
ttdinject.exe
Time Traver Debugging Application Injector file version info (xCyclopedia)
LOLBAS Execute 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 8 known copies with hashes
How ttdinject.exe is abused
Execute T1127 Trusted Developer Utilities Proxy Execution
-clientscenario-ddload-clientparams-launchEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ttdinject.exe.
2 documented commands
Execute T1127 Trusted Developer Utilities Proxy Execution Administrator privileges
Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.
TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"Trips 1 Sigma rule: mediumUse of TTDInject.exe by frack113
Execute T1127 Trusted Developer Utilities Proxy Execution Administrator privileges
Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated.
ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /launch "{PATH:.exe}"Trips 1 Sigma rule: mediumUse of TTDInject.exe by frack113
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for ttdinject.exe, by Maxime Nadeau, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ttdinject.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real ttdinject.exe?
C:\Windows\system32\C:\Windows\SysWOW64\8 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ttdinject.exe · signed by Microsoft Windows
c7a9ed79040cae7a53b278b80a4234b95c36505a1999280b75e5a24b4259b02510.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ttdinject.exe · signed by Microsoft Windows
f0a44d3c9ebc66e484e113088a9082f8939edad691f36c21be85cbfd994d1d9910.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ttdinject.exe · signed by Microsoft Windows
149306318334a101f6647718519477713a7ed2e50759258881ab28f4f04f5fa710.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ttdinject.exe · signed by Microsoft Windows
1cdf9d33b2c92a212c8a297802178127f354131d6d05641b6fdb6c52aff5fde310.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ttdinject.exe · signed by Microsoft Windows
3572ada17a4e88324a3295338cd9bf02bc9c76d881ab020576ff759733146dfa10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ttdinject.exe · signed by Microsoft Windows
b0f5d68dd83eb5bbce0d9bc331568ea5240b289d1dcd44d26f743fafa0d84bdc10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ttdinject.exe · signed by Microsoft Windows
6d42e1981e0b9d704351705b3f14e7e982766775ceda9d6a8ef15e9d7ec32f9910.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ttdinject.exe · signed by Microsoft Windows
c071ba0575ac5c43a97aac99ab5afc12b0d8b753fc575de07e893906c1dc003eFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.