Full Report
Windows Prefetch files were introduced in Windows XP and since that time have helped digital forensics analysts and incident responders find evidence of execution.
Analysis Summary
# Tool/Technique: Windows Prefetch Analysis
## Overview
Windows Prefetch files (.pf) are artifacts introduced in Windows XP to speed up application loading. For malware analysts and forensic responders, these files serve as a high-fidelity "evidence of execution" source, recording the execution history of binaries, their timestamps, and the files/directories they interacted with during the first 10 seconds of launch.
## Technical Details
- **Type:** Forensic Technique / OS Artifact
- **Platform:** Windows (XP through Windows 11)
- **Capabilities:** Tracking execution frequency, identifying last execution time, listing file handles/dependencies, and uncovering command-line parameters or loaded scripts.
- **First Seen:** 2001 (Windows XP release)
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1218.003 - System Binary Proxy Execution: CMSTP]
- [T1218.010 - System Binary Proxy Execution: Regsvr32]
- **[TA0003 - Persistence] / [TA0004 - Privilege Escalation]**
- [T1546.011 - Event Triggered Execution: Application Window Shim]
- **[TA0008 - Lateral Movement]**
- [T1021.002 - Remote Services: SMB/Windows Admin Shares]
- **[TA0005 - Defense Evasion]**
- [T1070.004 - Indicator Removal: File Deletion]
## Functionality
### Core Capabilities
- **Execution Evidence:** Confirms that a specific process ran on the system, even if the original binary has been deleted.
- **Dependency Mapping:** Records the first 10 seconds of file activity, listing DLLs, configuration files, and scripts loaded by the executable.
- **Volume Information:** Stores information about the volume on which the executable was stored.
### Advanced Features
- **Scriptlet Discovery:** By analyzing Prefetch files for `CMSTP.exe` or `Regsvr32.exe`, analysts can identify the specific `.txt`, `.sct`, or `.js` scriptlets used in "Living off the Land" attacks.
- **Shim Database Identification:** Allows responders to find custom `.sdb` files installed via `sdbinst.exe` for persistence.
- **Command-Line Insight:** In some cases (like `SDelete` or `PsExec`), the Prefetch file reveals the targets of the tool (e.g., what file was wiped or what service was installed).
## Indicators of Compromise
- **File Names:** Files located in `C:\Windows\Prefetch\` with the format `[EXENAME]-[HASH].pf`.
- **Behavioral Indicators:**
- Presence of `PSEXESVC.exe.pf` (indicates lateral movement).
- Presence of `SDELETE.exe.pf` (indicates anti-forensics/cleanup).
- Unusually named script files (e.g., `117696489.txt`) appearing in the file list of a system utility's Prefetch file.
## Associated Threat Actors
- **Cobalt Group:** Known for using `CMSTP.exe` and `Regsvr32.exe` to execute malicious scriptlets.
- **FIN7 / Carbanak:** Known for utilizing Application Shimming (`sdbinst.exe`) for persistence.
## Detection Methods
- **Forensic Parsing:** Use tools like `PECmd` or `WinPrefetchView` to parse the `.pf` binary format.
- **Behavioral detection:** Monitoring for the creation of `.pf` files associated with known dual-use tools (e.g., `mimikatz.exe.pf`, `psexec.exe.pf`).
- **Anomalous Hashing:** Identifying multiple Prefetch files for the same executable name with different hashes, indicating the binary was run from different paths.
## Mitigation Strategies
- **Endpoint Hardening:** Restrict the use of administrative tools like `PsExec` or `SDelete` via AppLocker or Windows Defender Application Control (WDAC).
- **Monitoring:** Enable auditing for process creation (Event ID 4688) to complement Prefetch data with full command-line arguments.
## Related Tools/Techniques
- **Amcache.hve:** Another Windows artifact providing metadata on executed programs.
- **Shimcache (AppCompatCache):** Tracks executables that were present on the system for compatibility purposes.
- **Superfetch:** An evolution of Prefetching for performance optimization.