Source: Wild
firefox.exe is the executable that launches the Firefox web browser.
EchoTrail Prevalence Score (EPS)
Rank Analysis
Host Prevalence
Execution Rank
Behavioral Analysis
Top Filenames
Top Paths
C:\Program Files (x86)\Mozilla Firefox
58.47 %
Top Network Ports
12.88 %
Ancestry Analysis
Top GrandParents
Top Parents
Top Children
Security Analysis
A typical detection hypothesis for behaviorally finding malicious activities stemming from a web browser is to look for shells (cmd.exe, powershell.exe, etc) being launched as a child process of the web browser. While this merits some attention sometimes, it is not abnormal enough to warrant a worthwhile high priority detection. This hypothesis is rather a decent second order indicator to prioritize another detection method or within a correlation rule. However, some APT style attacks will abuse common applications, such as web browsers, to take advantage of DLL load orders. In those scenarios, a legitimately-named-but-actually-malicious DLL will have been written in the same directory as the core web browser binary, thereby causing it to be loaded when the web browser is called. One method for detecting such an attack methodology would be to look for scheduled tasks launching web browsers, especially those where the task was scheduled remotely.