CmdID

CmdID / Files

iexplore.exe

Internet Explorer file version info

Program on Windows 6 known copies with hashes 19 Sigma rules name it Command iexplore

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real iexplore.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Internet Explorer\
C:\Program Files\internet explorer\
Signed byMicrosoft Windows
ProductInternet Explorer, Microsoft Corporation
DescriptionInternet Explorer

6 known copies

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Internet Explorer\iexplore.exe · signed by Microsoft Windows

219280ffebd3d771102fc3a7f26529e5e9161366e3a5de2f8943d81dda7756bf

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files\Internet Explorer\iexplore.exe · signed by Microsoft Windows

9c530f1306aa1312fda938169e208a033341bc49ff956695c7616ad6c5d4bc94

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Internet Explorer\iexplore.exe · signed by Microsoft Windows

e582676ec900249b408ab4e37976ae8c443635a7da77755daf6f896a172856a3

11.00.19041.1 (WinBuild.160101.0800) · C:\Program Files\Internet Explorer\iexplore.exe · signed by Microsoft Windows

f76f00939f1be76152809c37591ef75d3c150745232e35697d99cae09e31c2bc

11.00.17763.1 (WinBuild.160101.0800) · C:\Program Files\internet explorer\iexplore.exe · signed by Microsoft Windows

28fd5f83c7a2ed53c284ba791f0668c309e287576744530b6e9fc4c228d4b33b

11.00.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Internet Explorer\iexplore.exe · signed by Microsoft Windows

3be1abc6daf27760a91413b77c4ba0a73ef92115fda35ff6947b8ad937f54df9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name iexplore.exe
criticalExploiting CVE-2019-1388Florian Roth (Nextron Systems)
highMstsc.EXE Execution From Uncommon ParentNasreddine Bencherchali (Nextron Systems)
highSuspicious PowerShell Parent ProcessTeymur Kheirkhabarov, Harish Segar

Sigma names iexplore.exe in 19 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.