CmdID

CmdID / Files

PING.EXE

TCP/IP Ping Command file version info

Program on Windows 12 known copies with hashes 10 Sigma rules name it Command ping

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real PING.EXE?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTCP/IP Ping Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PING.EXE · signed by Microsoft Windows

b6701ce6ac0793169efc8f93a9bca05d5037c383106d69048060b2c0882b26d4

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PING.EXE · signed by Microsoft Windows

fb4355b69b0acc562ba3bad0b75de1d84dc02828099ce8c45a1b98ff41333778

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PING.EXE · signed by Microsoft Windows

4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PING.EXE · signed by Microsoft Windows

7af50fa112932ea3284f7821b2eea2b7582f558dba897231bb82182003c29f8b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PING.EXE · signed by Microsoft Windows

09e7534f7703b4e067455f0d83a77efa28a04c368381c5a0456282a57e801b04

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PING.EXE · signed by Microsoft Windows

e9ef80a7849f1cf02cb5fb8396ff9e270cb9006f30294a52c6490a72b373be00

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\PING.EXE · signed by Microsoft Windows

741ad992403c78a8a7dbd97c74fda06594a247e9e2fa05a40bb6945403a90056

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PING.EXE · signed by Microsoft Windows

c370e9606a929aca877e7e5267a9f05ffa09a7cc4c53575b3be8216dfed945b1

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\PING.EXE · signed by Microsoft Windows

bdc34d4260925e54b84395b8167ca5d6f9c4aa2e047221c14f7736dddeb13906

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\PING.EXE · signed by Microsoft Windows

ed7fa5b3ccbdd31a9e83f7c59f78ab5e2c83c7feedcc5f8b95948d11ebd7ff34

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\PING.EXE · not signed

a510579a207c53ba35ef3551d2d62cfd9fe0e9d7f13c1dd6beb8ced0d7f1154e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\PING.EXE · not signed

e3cd6a30d8eea5ba802a453c9ff6225625a61074323e956fb04854e2f3eb627e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name PING.EXE
criticalPotential QBot ActivityFlorian Roth (Nextron Systems)
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highPing Hex IPFlorian Roth (Nextron Systems)
highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga
highSuspicious SYSTEM User Process CreationFlorian Roth (Nextron Systems), David ANDRE (additional keywords)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumObfuscated IP Via CLINasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)

Sigma names PING.EXE in 10 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.