CmdID / Files

chrome.exe

Google Chrome file version info

Program on Windows 4 known copies with hashes 38 Sigma rules name it

Is it the real chrome.exe?

file version info and known copies

Installed inC:\Program Files\Google\Chrome\Application\
C:\Program Files (x86)\Google\Chrome\Application\

Signed byGoogle LLC

ProductGoogle Chrome, Google LLC

DescriptionGoogle Chrome

4 known copies

95.0.4638.69 · C:\Program Files\Google\Chrome\Application\chrome.exe · signed by Google LLC

768b39d67fe884b1b216803b76f5afcefadb860544fd0e52c3f286670a740dbb

85.0.4183.121 · C:\Program Files\Google\Chrome\Application\chrome.exe · signed by Google LLC

d2fa08ef73b5fb55e29ae09e8285df99354b5bb9d2c751f9a15bd3a171522a3c

85.0.4183.83 · C:\program files\Google\Chrome\Application\chrome.exe · signed by Google LLC

67eb9077ab29c8a45578c6636d68014e60aeb0f77fbfa5c48fb93ee5e0d85e41

84.0.4147.125 · C:\Program Files (x86)\Google\Chrome\Application\chrome.exe · signed by Google LLC

7cf0bb881e8ee0b4ed43d73b4eca634f9c1b14d2de4de916177bb4ed2939f16e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name chrome.exe

highChromeLoader Malware Execution@kostastsale

highChromium Browser Headless Execution To Mockbin Like SiteX__Junior (Nextron Systems)

highFile Download with Headless BrowserSreeman, Florian Roth (Nextron Systems)

highInjected Browser Process Spawning Rundll32 - GuLoader Activity@kostastsale

highMstsc.EXE Execution From Uncommon ParentNasreddine Bencherchali (Nextron Systems)

highSuspicious Chromium Browser Instance Executed With Custom ExtensionAedan Russell, frack113, X__Junior (Nextron Systems)

highSuspicious FileFix Execution Pattern0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious PowerShell Parent ProcessTeymur Kheirkhabarov, Harish Segar

mediumChromium Browser Instance Executed With Custom ExtensionAedan Russell, frack113, X__Junior (Nextron Systems)

mediumFile Download From Browser Process Via Inline URLFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumPotential Suspicious Browser Launch From Document Reader ProcessJoseph Kamau

mediumPotentially Suspicious Electron Application CommandLinefrack113, Nasreddine Bencherchali (Nextron Systems)

mediumSuspicious Electron Application Child ProcessesNasreddine Bencherchali (Nextron Systems)

lowBrowser Execution In Headless ModeNasreddine Bencherchali (Nextron Systems)

lowHTML File Opened From Download FolderJoseph Kamau

Sigma names chrome.exe in 38 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.