Windows prefetch analysis

Windows Prefetch Analysis

When to Use

• When investigating a compromised Windows system to answer the question: "Did the attacker actually run this tool/malware?"
• To build a timeline of threat actor activities by examining execution timestamps and accessed files.
• When an attacker has deleted their malware, but the prefetch file remains as evidence.

Prerequisites

• Forensic image or live access to the affected system(s)
• Forensic workstation with analysis tools (Autopsy, Volatility, Timeline Explorer)
• Chain of custody documentation initiated for evidence handling
• Write-blocker for disk forensics or memory acquisition tool (e.g., DumpIt, WinPmem)

Workflow

Phase 1: Locating and Understanding Prefetch Files

Prefetch files are typically located at C:\Windows\Prefetch. They are named ending with .pf (e.g., CMD.EXE-4A81B364.pf).

Note: Prefetch is enabled by default on Windows Client OS architectures but may be disabled on Windows Servers.

Phase 2: Offline Analysis with PECmd (Eric Zimmerman's Tools)

# Concept: Parse a single prefetch file PECmd.exe -f "C:\Windows\Prefetch\MIMIKATZ.EXE-53D22409.pf"

# PECmd.exe -d "C:\Windows\Prefetch\" -q --csv "C:\Forensics\Output" --csvf "prefetch_timeline.csv"

Phase 3: Interpreting the Output

When examining the parsed output, focus on:

• Run Count: How many times was the binary executed?
• Execution Times: Up to 8 previous execution timestamps (depending on OS version). Last execution time is crucial for timeline building.
• Files/Directories Accessed: The directories and files the program loaded (e.g., DLLs, configuration files, text files the attacker interacted with).

Phase 4: Basic Live System Check (Powershell)

# Get-ChildItem -Path "C:\Windows\Prefetch" | Where-Object { $_.Name -match "MIMIKATZ|PSEXEC|NC.EXE" } | Select-Object Name, LastWriteTime

Decision Point 🔀

flowchart TD
    A[Locate Prefetch Folder ] --> B{Prefetch Enabled? ]}
    B -->|Yes| C[Extract .pf Files ]
    B -->|No| D[Check ShimCache/Amcache ]
    C --> E[Parse with PECmd ]

🔵 Blue Team Detection & Defense

• Monitor Deletion of Prefetch Files: Centralized Forensics Collection: Threat Hunting via File Paths: Key Concepts | Concept | Description | |---------|-------------|

Output Format

Windows Prefetch Analysis — Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]

Findings Summary:
  [Finding 1]: [Severity] — [Brief description]
  [Finding 2]: [Severity] — [Brief description]

Detailed Results:
  Phase 1: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

  Phase 2: [Phase name]
    - Result: [Outcome]
    - Evidence: [Screenshot/log reference]
    - Impact: [Business impact assessment]

Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
  1. [Immediate remediation step]
  2. [Long-term hardening measure]
  3. [Monitoring/detection improvement]

📚 Shared Resources

For cross-cutting methodology applicable to all vulnerability classes, see:

• _shared/references/elite-chaining-strategy.md — Exploit chaining methodology and high-payout chain patterns
• _shared/references/elite-report-writing.md — HackerOne-optimized report writing, CWE quick reference
• _shared/references/real-world-bounties.md — Verified disclosed bounties by vulnerability class

References

• SANS InfoSec Reading Room: Prefetch Forensics
• Eric Zimmerman Tools: PECmd