Windows Forensics 102: Execution Artifacts: Proving Someone Was Here

Series: Windows Forensics | Author: Tech Corsair | Published: techcorsair.co.uk

There's a certain satisfaction in catching someone out. Not in a malicious way -- more in the Columbo sense. "Just one more thing, sir… if you never ran that program, why does your Prefetch folder disagree?"

Windows is, without a doubt, the world's most thorough surveillance system that people voluntarily install on their own computers. It tracks what programs run, when they run, how often they run, and what files they touch in the process. Users agreed to all of this, of course. It was in the terms and conditions. Right there on page 347, paragraph 12, subsection (c). Nobody read it, but that's rather the point.

For forensic analysts, execution artefacts are the crown jewels. Finding a suspicious file on a system is one thing. Proving it actually executed is what turns "there was malware present" into "the malware ran, and here's exactly when." That's the difference between "concerning" and "confirmed incident."

Let's examine the five major execution artefacts that Windows so helpfully maintains.

Prefetch: The Eager Helper

Location: C:\Windows\Prefetch\

File Format: -.pf

Prefetch was designed to speed up application loading by pre-caching data from previous runs. In doing so, it accidentally created one of the most useful forensic artefacts in existence. This is the forensic equivalent of a burglar signing the guest book on the way in.

What Prefetch Records

Key Details

• Windows 10/11 stores the last 8 execution timestamps per Prefetch file. Older versions stored only the last run time.
• Prefetch must be enabled (it's on by default for HDDs, sometimes disabled on SSDs, though Windows 10+ generally enables it regardless).
• Maximum of 1024 Prefetch files on Windows 10/11 (older versions capped at 128). When the limit is reached, oldest files are purged.
• The hash in the filename is derived from the executable path, so the same executable run from different locations generates different Prefetch files.

File:           MIMIKATZ.EXE-A91B894D.pf
Run Count:      3
Last Run:       2024-03-15 02:48:15 UTC
Previous Runs:  2024-03-15 02:35:22 UTC
                2024-03-14 23:17:44 UTC

Files Referenced:
  \WINDOWS\SYSTEM32\NTDLL.DLL
  \WINDOWS\SYSTEM32\KERNEL32.DLL
  \USERS\ADMIN\DESKTOP\MIMIKATZ.EXE

Three executions of Mimikatz from the admin's desktop, starting just before midnight. That's what forensic practitioners call "a bad day for somebody."

Analysis with PECmd

Eric Zimmerman's PECmd is the go-to tool for Prefetch analysis:

# Parse a single Prefetch file
PECmd.exe -f "C:\Windows\Prefetch\MIMIKATZ.EXE-A91B894D.pf"

# Parse the entire Prefetch directory to CSV
PECmd.exe -d "C:\Evidence\Prefetch" --csv "C:\Output" --csvf prefetch_results.csv

# Parse with JSON output
PECmd.exe -d "C:\Evidence\Prefetch" --json "C:\Output"

Prefetch Gotchas

• Disabled by default on some SSDs -- check HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters. Value of EnablePrefetcher: 0 = disabled, 1 = application only, 2 = boot only, 3 = both.
• Not present on Windows Server by default. Servers disable Prefetch because they run the same applications consistently. Attackers know this, which is why Shimcache and Amcache become even more critical on servers.
• Compressed with MACompression on Windows 10+. Raw hex viewing won't help -- use proper tools.

Shimcache (AppCompatCache): The Compatibility Historian

Location: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

Stored in: SYSTEM registry hive

Shimcache -- properly known as the Application Compatibility Cache -- exists because Microsoft needed backward compatibility for applications designed for older Windows versions. In maintaining this cache, Windows records metadata about executables that the operating system has interacted with. It's the registry's way of keeping notes "just in case."

What Shimcache Records

Critical Caveats

This is where things get a bit nuanced, and where forensic practitioners earn their keep:

• On Windows 10/11, Shimcache does NOT definitively prove execution. A file can appear in Shimcache simply by being present in a directory that was browsed in Explorer, or through other file system interactions. The execution flag became unreliable from Windows 10 onwards.
• Shimcache is only written to the registry at shutdown. If a system crashes or is powered off without a clean shutdown, the most recent Shimcache data is lost.
• Entry position matters. Newer entries are at the top. The ordering can help establish a rough timeline even without explicit timestamps.

Entry Position: 12
Path:           C:\Windows\Temp\beacon.exe
Last Modified:  2024-03-14 22:30:00 UTC
Execution Flag: True (but take with a grain of salt on Win10+)

Analysis with AppCompatCacheParser

# Parse Shimcache from a SYSTEM hive
AppCompatCacheParser.exe -f "C:\Evidence\SYSTEM" --csv "C:\Output" --csvf shimcache.csv

# Parse from a live system
AppCompatCacheParser.exe --csv "C:\Output" --csvf shimcache_live.csv

Shimcache vs Prefetch: The Comparison Nobody Asked For

Use both. They complement each other like tea and biscuits -- fine individually, better together.

Amcache: The Detailed Record-Keeper

Location: C:\Windows\AppCompat\Programs\Amcache.hve

Amcache is a standalone registry hive (not part of the main SYSTEM or SOFTWARE hives) that records information about applications and executables. It was introduced in Windows 8 and is significantly more detailed than Shimcache.

What Amcache Records

The SHA1 hash is the standout feature here. While Prefetch tells you what ran and Shimcache provides compatibility data, Amcache gives you a cryptographic hash you can run against threat intelligence databases. "Was this the known-bad version of that tool?" Amcache answers that question.

File:           C:\Users\jdoe\Downloads\update_helper.exe
SHA1:           a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
Size:           245760 bytes
Publisher:      (none)
Compile Time:   2024-03-10 15:22:00 UTC
First Run:      2024-03-15 02:35:00 UTC

No publisher, compiled five days before execution, sitting in a user's Downloads folder. The forensic alarm bells should be deafening at this point.

Analysis with AmcacheParser

# Parse Amcache.hve to CSV
AmcacheParser.exe -f "C:\Evidence\Amcache.hve" --csv "C:\Output" --csvf amcache.csv

# Include unassociated file entries
AmcacheParser.exe -f "C:\Evidence\Amcache.hve" -i --csv "C:\Output" --csvf amcache_full.csv

Amcache Structure (Windows 10+)

The Amcache hive has been reorganised over Windows versions. On modern systems, key locations include:

Amcache.hve\Root\InventoryApplicationFile    -- Installed application files
Amcache.hve\Root\InventoryApplication        -- Application metadata
Amcache.hve\Root\InventoryDeviceContainer    -- Device information
Amcache.hve\Root\InventoryDriverBinary       -- Driver details

BAM/DAM: The Background Activity Monitors

Location (BAM): SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\{SID}

Location (DAM): SYSTEM\CurrentControlSet\Services\dam\State\UserSettings\{SID}

The Background Activity Monitor (BAM) and Desktop Activity Moderator (DAM) were introduced in Windows 10 1709 (Fall Creators Update). They track application execution with full paths and timestamps, and -- critically -- they associate execution with a specific user SID.

Why BAM/DAM Matters

Most execution artefacts tell you that something ran. BAM/DAM tells you who ran it. This is enormously valuable in multi-user systems or when an attacker has compromised a specific user account.

User SID:   S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-1001
Entry:      \Device\HarddiskVolume3\Users\jdoe\Desktop\psexec64.exe
Timestamp:  2024-03-15 02:40:22 UTC

BAM/DAM Caveats

• Data is retained for approximately 7 days before being cleaned up. The forensic window is narrow.
• Not all executions are captured -- BAM primarily tracks foreground GUI applications.
• Available from Windows 10 1709 onwards only.
• Structure changed between Windows versions. Always verify the exact path for your target OS version.

# Extract BAM data using RECmd
RECmd.exe -f "C:\Evidence\SYSTEM" --bn BatchExamples\RECmd_Batch_MC.reb --csv "C:\Output"

# Or use RegRipper
rip.exe -r "C:\Evidence\SYSTEM" -p bam

UserAssist: The GUI Execution Tracker

Location: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

UserAssist tracks programs launched via Windows Explorer (the shell, not Internet Explorer -- though tracking the latter would have been equally entertaining). It records execution counts and timestamps for GUI-based program launches.

The ROT13 Situation

For reasons best known to someone at Microsoft in approximately 2001, UserAssist entries are encoded in ROT13. This is a Caesar cipher with a shift of 13. It is to cryptography what a "Beware of the Dog" sign is to home security -- it signals intent without providing actual protection.

Encoded:    {PZFVQM-SNBG1-4Q2R}\Zvpebfbsg.CbjreFuryy_v1.exe
Decoded:    {CMSIDE-FAOT1-4D2E}\Microsoft.PowerShell_i1.exe
Run Count:  5
Last Run:   2024-03-15 02:42:00 UTC
Focus Time: 180 seconds

UserAssist GUIDs

Two GUIDs are commonly seen:

Analysis

UserAssist is well-supported by Registry Explorer (which decodes ROT13 automatically) and RegRipper:

# RegRipper plugin for UserAssist
rip.exe -r "C:\Evidence\NTUSER.DAT" -p userassist

Bringing It All Together: The Execution Artefact Matrix

When investigating program execution, no single artefact tells the complete story. The security community recommends checking all available sources and cross-referencing:

The ideal scenario: you find an executable in Prefetch (proving execution with timestamps), Amcache (giving you a SHA1 hash for IOC matching), and BAM (telling you which user ran it). That's the forensic trifecta. You could frame it.

Practical Investigation Workflow

1. Start with Prefetch -- it's the most reliable indicator of execution and gives you timestamps and referenced files.
2. Check Amcache -- get the SHA1 hash and run it against VirusTotal, your threat intel platform, or your YARA rules.
3. Cross-reference BAM/DAM -- if within the 7-day window, identify the user who ran the program.
4. Review Shimcache -- even if it doesn't prove execution on Windows 10+, the presence of an entry and its position can support your timeline.
5. Examine UserAssist -- for GUI-launched programs, you get run counts and focus time.

# KAPE module for comprehensive execution artefact collection
kape.exe --tsource C: --tdest C:\Evidence --target Prefetch,Amcache,RegistryHives
kape.exe --msource C:\Evidence --mdest C:\Output --module PECmd,AmcacheParser,AppCompatCacheParser

---

What's Next in the Series

This is part of the Windows Forensics series on techcorsair.co.uk:

• WF-101: The Registry -- Where Windows keeps its diary. The foundation for everything else.
• WF-102: Execution Artifacts -- You are here. Proving someone was here.
• WF-104: Event Logs -- The world's most boring novel that could save your job.
• WF-105: USB Devices & Persistence -- Who plugged what where, and why won't this malware leave?

Now that you can prove what ran and when, the next step is understanding the broader story. Event logs provide the narrative context -- logins, privilege use, process creation -- that turns individual artefacts into a coherent timeline. They're also approximately as exciting to read as a telephone directory, but considerably more important.

---

Tech Corsair -- Proving things happened since… well, we can check the Prefetch for that.