d83007a6d95188d14cd71e0a33f2030248288303dffa7202efec70b517fc66e7
Source: Wild
Summary
firefox.exe is the executable that launches the Firefox web browser.
EchoTrail Prevalence Score (EPS)
41.23
Rank Analysis
Host Prevalence
35.0%
Execution Rank
42,431st
Behavioral Analysis
Top Filenames
Top Paths
C:\Program Files (x86)\Mozilla Firefox
58.47 %
loading...
Top Network Ports
49680
12.88 %
loading...
Ancestry Analysis
Top GrandParents
Top Parents
Top Children
Security Analysis
Intel
A typical detection hypothesis for behaviorally finding malicious activities stemming from a web browser is to look for shells (cmd.exe, powershell.exe, etc) being launched as a child process of the web browser. While this merits some attention sometimes, it is not abnormal enough to warrant a worthwhile high priority detection. This hypothesis is rather a decent second order indicator to prioritize another detection method or within a correlation rule. However, some APT style attacks will abuse common applications, such as web browsers, to take advantage of DLL load orders. In those scenarios, a legitimately-named-but-actually-malicious DLL will have been written in the same directory as the core web browser binary, thereby causing it to be loaded when the web browser is called. One method for detecting such an attack methodology would be to look for scheduled tasks launching web browsers, especially those where the task was scheduled remotely.