CmdID

CmdID / Files

elevation_service.exe

Google Chrome file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real elevation_service.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Google\Chrome\Application\84.0.4147.125\
C:\Program Files (x86)\Microsoft\Edge\Application\85.0.564.68\
C:\Program Files (x86)\Microsoft\Edge\Application\95.0.1020.40\
Signed byGoogle LLC
ProductGoogle Chrome, Google LLC
DescriptionGoogle Chrome

6 known copies

95.0.4638.69 · C:\Program Files\Google\Chrome\Application\95.0.4638.69\elevation_service.exe · signed by Google LLC

dbcd26f229afac2d0dc2e30a7dc3e0d1c0f2360af7ef9e6da5f273100e382f65

95.0.1020.40 · C:\Program Files (x86)\Microsoft\Edge\Application\95.0.1020.40\elevation_service.exe · signed by Microsoft Corporation

d8d2ea11daed71092ccfd6b20a68dfeb358de0055da15b5e89727ab486d84799

85.0.4183.121 · C:\Program Files\Google\Chrome\Application\85.0.4183.121\elevation_service.exe · signed by Google LLC

54110545034f5bd5f43f1849aa40dadafbf0df61d61e208851782f4ee23499b3

85.0.4183.83 · C:\program files\Google\Chrome\Application\85.0.4183.83\elevation_service.exe · signed by Google LLC

241a9c249468e151d97d9768ab2c2f90d78a9070965f87b0713d6f53408a461d

85.0.564.68 · C:\Program Files (x86)\Microsoft\Edge\Application\85.0.564.68\elevation_service.exe · signed by Microsoft Corporation

0b2c142f42af50e926674deaf0a1bbd13e8aa88f19a306959aaca138fc64ab10

84.0.4147.125 · C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.125\elevation_service.exe · signed by Google LLC

3acb5939358b4209d8b443f215b325a3f48a5c4ada992abe4ddef9c88b60abbd

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name elevation_service.exe
criticalPotential CVE-2021-41379 Exploitation AttemptFlorian Roth (Nextron Systems)

Sigma names elevation_service.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.