5fafd290309cb836f8495c5015568792ff6f04eb4fc32d51f0944f54dae8468f
Source: Wild
Summary
Chrome.exe is the executable that launches the Google Chrome Browser.
EchoTrail Prevalence Score (EPS)
57.26
Rank Analysis
Host Prevalence
81.8%
Execution Rank
96,109th
Behavioral Analysis
Top Filenames
Top Paths
C:\Program Files (x86)\Google\Chrome\Application
97.38 %
loading...
Top Network Ports
5353
55.84 %
loading...
Ancestry Analysis
Top GrandParents
Top Parents
Top Children
Security Analysis
Intel
A typical detection hypothesis for behaviorally finding malicious activities stemming from a web browser is to look for shells (cmd.exe, powershell.exe, etc) being launched as a child process of the web browser. While this merits some attention sometimes, it is not abnormal enough to warrant a worthwhile high priority detection. This hypothesis is rather a decent second order indicator to prioritize another detection method or within a correlation rule. However, some APT style attacks will abuse common applications, such as web browsers, to take advantage of DLL load orders. In those scenarios, a legitimately-named-but-actually-malicious DLL will have been written in the same directory as the core web browser binary, thereby causing it to be loaded when the web browser is called. One method for detecting such an attack methodology would be to look for scheduled tasks launching web browsers, especially those where the task was scheduled remotely.