TRACERT.EXE

  • File Path: C:\WINDOWS\system32\TRACERT.EXE
  • Description: TCP/IP Traceroute Command

Hashes

Type Hash
MD5 42076FB86BE995F7EE6F37CD91E90E60
SHA1 0E1A7BAEF1BD70A2010AEF0BF4A512A44AEF92A4
SHA256 E5DCF73DFAE083098AD910CC9784AE89CE48A070D4DB3037F337F569FC6F2729
SHA384 E4C7F05AB4547DC5A33DA6493595E3C0FE0C8BC9C014FF1E10C86182C7C155DBBDDE38069AD4DBBE68F3ACEE4C683BEA
SHA512 11B07C7F27F0BD14EBD6D4EBE76BC34E63DB393E6534F7BA68F8FE954587C5817DA6C891216D419DE04A1CA212F4F42C56E02363FA9EC975EA0A31F0F8CAD43A
SSDEEP 384:jYeZmdMz33bu4Db39icD5IqBEUlbDjxb4Etmd2LeFtBWBaW:keZm0bu0b3qcEeB4d2LeFtE
IMP 864ED1A3925E3BF68245CEBDFEE0C895
PESHA1 FC6A8DFBC6E96B2B97A7C476D229A6C0C0630F1C
PE256 B5771929EDDCEB89CD687340D8D55D67EF76A1EED8BE4C2282694944F029CF3E

Runtime Data

Usage (stdout):

--help is not a valid command option.

Usage: tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] 
               [-R] [-S srcaddr] [-4] [-6] target_name

Options:
    -d                 Do not resolve addresses to hostnames.
    -h maximum_hops    Maximum number of hops to search for target.
    -j host-list       Loose source route along host-list (IPv4-only).
    -w timeout         Wait timeout milliseconds for each reply.
    -R                 Trace round-trip path (IPv6-only).
    -S srcaddr         Source address to use (IPv6-only).
    -4                 Force using IPv4.
    -6                 Force using IPv6.

Child Processes:

conhost.exe

Open Handles:

Path Type
(RW-) C:\Windows\System32 File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\TRACERT.EXE

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: tracert.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/e5dcf73dfae083098ad910cc9784ae89ce48a070d4db3037f337f569fc6f2729/detection

Possible Misuse

The following table contains possible examples of TRACERT.EXE being misused. While TRACERT.EXE is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma win_multiple_suspicious_cli.yml - tracert.exe DRL 1.0
sigma win_webshell_detection.yml - '\tracert.exe' DRL 1.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


tracert

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

This diagnostic tool determines the path taken to a destination by sending Internet Control Message Protocol (ICMP) echo Request or ICMPv6 messages to the destination with incrementally increasing time to live (TTL) field values. Each router along the path is required to decrement the TTL in an IP packet by at least 1 before forwarding it. Effectively, the TTL is a maximum link counter. When the TTL on a packet reaches 0, the router is expected to return an ICMP time Exceeded message to the source computer.

This command determines the path by sending the first echo Request message with a TTL of 1 and incrementing the TTL by 1 on each subsequent transmission until the target responds or the maximum number of hops is reached. The maximum number of hops is 30 by default and can be specified using the /h parameter.

The path is determined by examining the ICMP time Exceeded messages returned by intermediate routers and the echo Reply message returned by the destination. However, some routers do not return time Exceeded messages for packets with expired TTL values and are invisible to the tracert command. In this case, a row of asterisks (*) is displayed for that hop. The path displayed is the list of near/side router interfaces of the routers in the path between a source host and a destination. The near/side interface is the interface of the router that is closest to the sending host in the path.

[!IMPORTANT] This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.

To trace a path and provide network latency and packet loss for each router and link in the path, use the pathping command command.

Syntax

tracert [/d] [/h <maximumhops>] [/j <hostlist>] [/w <timeout>] [/R] [/S <srcaddr>] [/4][/6] <targetname>

Parameters

Parameter Description
/d Stops attempts to resolve the IP addresses of intermediate routers to their names. This can speed up the return of results.
/h <maximumhops> Specifies the maximum number of hops in the path to search for the target (destination). The default is 30 hops.
/j <hostlist> Specifies that echo Request messages use the Loose Source Route option in the IP header with the set of intermediate destinations specified in <hostlist>. With loose source routing, successive intermediate destinations can be separated by one or multiple routers. The maximum number of addresses or names in the list is 9. The <hostlist> is a series of IP addresses (in dotted decimal notation) separated by spaces. Use this parameter only when tracing IPv4 addresses.
/w <timeout> Specifies the amount of time in milliseconds to wait for the ICMP time Exceeded or echo Reply message corresponding to a given echo Request message to be received. If not received within the time-out, an asterisk (*) is displayed. The default time-out is 4000 (4 seconds).
/R Specifies that the IPv6 Routing extension header be used to send an echo Request message to the local host, using the destination as an intermediate destination and testing the reverse route.
/S <srcaddr> Specifies the source address to use in the echo Request messages. Use this parameter only when tracing IPv6 addresses.
/4 Specifies that tracert.exe can use only IPv4 for this trace.
/6 Specifies that tracert.exe can use only IPv6 for this trace.
<targetname> Specifies the destination, identified either by IP address or host name.
/? Displays help at the command prompt.

Examples

To trace the path to the host named corp7.microsoft.com, type:

tracert corp7.microsoft.com

To trace the path to the host named corp7.microsoft.com and prevent the resolution of each IP address to its name, type:

tracert /d corp7.microsoft.com

To trace the path to the host named corp7.microsoft.com and use the loose source route 10.12.0.1/10.29.3.1/10.1.44.1, type:

tracert /j 10.12.0.1 10.29.3.1 10.1.44.1 corp7.microsoft.com

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.