If the window being displayed is a terminal emulator (PuTTY or Rumba for example), showing a COBOL program running on UNIX/Linux, then when the user clicks the X in the upper corner of the window, the running program receives the signal named SIGTERM, and in response to this signal, the program exits gracefully, closing any open files, flushing buffers, etc.  It's the same as a STOP RUN.  

I assume something similar happens, for windows where the COBOL program is running locally on the Windows machine, though I am not certain, and I must leave this answer to other experts.

For programs compiled with Net Express and running under Windows, clicking on the close button of a console window will be trapped and processed by the RTS and the program will be terminated gracefully as if a stop run were executed.

You can also trap this type of event using the CBL_EXIT_PROC routine so that when the close occurs you can execute your own closedown code if required.

Example:

      id division.                                              
      program-id.   testexit.                                    
      data division.                                            
      working-storage section.                                  
      01 install-flag         pic x    comp-x value 0.          
      01 install-params.                                        
         05 install-addrs     procedure-pointer.                
         05 install-priority  pic x    comp-x.                  
      01 status-code          pic x(4) comp-5 value 0.          
      01 any-key              pic x.                            
      procedure division.                                        
           set install-addrs to entry "myclose"                  
           call "CBL_EXIT_PROC"                                  
              using install-flag                                
                    install-params                              
              returning status-code                              
           end-call                                              
           display "this is test"                                
           accept any-key                                        
           display "after accept"                                
           stop run.                                            

      entry "myclose".                                          
           display "in close procedure".