3aa971f794df79ec6e7d22a4d3b4f3eac1dfe8a8192601445baeffdf994e23e2
Source: Wild
Summary
iexplore.exe is the executable that launches the Microsoft Internet Explorer web browser.
EchoTrail Prevalence Score (EPS)
79.06
Rank Analysis
Host Prevalence
73.2%
Execution Rank
6,928th
Behavioral Analysis
Top Filenames
Top Paths
C:\Program Files (x86)\Internet Explorer
57.45 %
loading...
Top Network Ports
49709
15.90 %
loading...
Ancestry Analysis
Top GrandParents
Top Parents
Top Children
Security Analysis
Intel
A typical detection hypothesis for behaviorally finding malicious activities stemming from a web browser is to look for shells (cmd.exe, powershell.exe, etc) being launched as a child process of the web browser. While this merits some attention sometimes, it is not abnormal enough to warrant a worthwhile high priority detection. This hypothesis is rather a decent second order indicator to prioritize another detection method or within a correlation rule. However, some APT style attacks will abuse common applications, such as web browsers, to take advantage of DLL load orders. In those scenarios, a legitimately-named-but-actually-malicious DLL will have been written in the same directory as the core web browser binary, thereby causing it to be loaded when the web browser is called. One method for detecting such an attack methodology would be to look for scheduled tasks launching web browsers, especially those where the task was scheduled remotely.