CmdID

CmdID / Files

TRACERT.EXE

TCP/IP Traceroute Command file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command tracert

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TRACERT.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP Traceroute Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TRACERT.EXE · signed by Microsoft Windows

db796c9cc5b166af946ef1160fbe8367fde2c69574c97ca7281a5dfbcf1fedc1

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TRACERT.EXE · signed by Microsoft Windows

e5dcf73dfae083098ad910cc9784ae89ce48a070d4db3037f337f569fc6f2729

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TRACERT.EXE · signed by Microsoft Windows

5572cccbc800ddc2b9788c5b888007fc5da88ab5712c3414af7799e4f2e04ff9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\TRACERT.EXE · signed by Microsoft Windows

743f8e8a91b2d1e0db9323109034de91a1e065242a33a90bb787a63edb860b35

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TRACERT.EXE · signed by Microsoft Windows

5817a6b5d24d21e19a05a08253737b1d2842b612ec1b90f9b928d78fad271092

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\TRACERT.EXE · signed by Microsoft Windows

618b29888378dad8e326059deb324d34a9b51c7c00bd0afb2270bb37fdc428bc

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\TRACERT.EXE · signed by Microsoft Windows

9d950a12f26b79f07c7c44edc1e0c6ed318f1ceec677574ae866d83149a3e600

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\TRACERT.EXE · signed by Microsoft Windows

a7a0cb3a7867d8ce594daebfc7571eb5cd59be321d4d45296be378efe66109a2

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\TRACERT.EXE · signed by Microsoft Windows

76feb1d499dd6f349e80508fbb2c1dfc594a2b58d0563341c2eac89b786ff3e7

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\TRACERT.EXE · signed by Microsoft Windows

a2b9965ce3c54e3f5f8cdcd57d955d320cf41f06ed6d62be5d1d64a0eb19267e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\TRACERT.EXE · not signed

4e8114c4ecb6affedbf56fad3f5a11101cfea6a05c6bf00cde4be45db682a2bd

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\TRACERT.EXE · not signed

61c0ca8e85623254fdc4a5faae60789888cdbdeb2e302092b5f4846d9ec68ba8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name TRACERT.EXE
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson