Windows

There are lot’s of evidence of installation and execution. Based on this data one can prove that the user knew about it or not. Below are the main evidence, tools for analysis and .

It’s not always about malware. Sometimes it’s just about user activity.

Evidence of Execution

\Windows\Prefetch
\Windows\appcompat\Programs\RecentFileCache.bcf
\Windows\appcompat\Programs\Amcache.hve
\Windows\appcompat\Programs\Amcache.hve.LOG

Dr Watson

Drwtsn32.log, traps a crashing program. Can create a file named User.dmp. 100% prove that the program was executed.

Installed programs and applications

Key 🔑: Microsoft\Windows\CurrentVersion\Uninstall. There can be some data for programs that do not exist on the system anymore. The last write time is when the application was installed.

Key 🔑 Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore for installed Microsoft applications. Defines between those that were installed for a specific user or system-wide.

Key 🔑: Wiw6432Node (SYSTEM hive root node) - those that run a 32-bit mode. Separate sub-keys for different versions of a program.

Key 🔑: Classes\Installer\Products - installed using Miscrosoft installer (those with msi extension).

Prefetch

rip.exe -r SYSTEM -p prefetch # to show whether prefetch is enabled

rip.exe -r SYSTEM -p prefetch # to show whether prefetch is enabled

prefetch.py -c -d -e
prefetch.py -c -d > pf.csv
prefetch.py -f <file_to_parse> > pf.txt

PECmd.exe -f <pffile>.pf
PECmd.exe -d "Prefetch folder" --csv "outoutdir" --csvf "outputfile"

AmCache

AmcacheParser.exe -f <path_to_AmCache.hve> -i on --csv <export_to_folder_no_quotes> --csvf <desired_filename> 

AppCompatCache aka ShimCache

Key 🔑: CurrentControlSet\Control\Session Manager\AppCompatCache\AppCompatCache.

🛠: ShimCacheParser.py (requires Python2), AppCompatCacheParser

Originally was used to identify compatibility issues between 32 and 64 bit progs. Track the file path, size, last modified time ⏰. Only logs specific file extensions. It might not be a reliable evidnce that the program was executed or even installation, but if the program was installed and deleted - it won’t be deleted from here. ShimCache is another name for this artifact. Uses file system timestamps.

If the executable is modified or renamed, new entry will be created, but modified date and time will be the same for both files even after these actions take place. $UsnJrnl is another place to make sure that is what had happened. $Logfile.

⚠️ Written at shutdown!

⚠️ Doesn’t track the file execution for Win7+ systems.

BAM

Key 🔑: ControlSet001\Services\BAM.

⚠️ Windows 10 only!

Background Activity Monitor. Organaized by user SID. Windows apps’ names are not parsed very well here. Gives last executed time ⏰ , 64-bit little-endian (first 8 bytes of the value). It does prove program execution and it ties it to the specific user. May use the same technique for core processes analysis and identifying rogue processes like in RAM.

MUICache

Key 🔑: Local Settings\Software\Microsoft\Windows\Shell\MuiCache.

Installed and executed applications for that particular user. But no timestamps for this acts, only last write data and time for the key in registry.

ComDlg32

Key 🔑: NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32.

CIDSizeMRU- Tracks applications globally. MRU start at zero. Timestamp for the most recent item only. FirstFolder -tracks the install locations of applications, full path to the app, but no exact file name. OpenSavePidMRU - tracks files that were saved with Save As dialog, or opened with Open dialog. Tracks autocomplete terms. LastVisitedPidMRU - tracks the specific executable used by an application to open the files documented in the OpenSaveMRU key. Also tracks the directory for the last application accessed for each file in OpenSavePidMRU, tracks the location the file existed.

Jump List Data

Key 🔑: NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData.

Shows applications accessed.

Recent Apps

Key 🔑: NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps.

Similar to User Assist. Also shows files and applications that were used through this application. This key consists of sub-keys that are marked with application’s GUID. Some of them will have Recent Items sub-key (10 max), each has Last Write Time (Windows 64-bit, little-endian).

⚠️ Not all Win10 machines will have this key.

Key 🔑: Software\Microsoft\Windows\Current Version\Explorer\RunMRU.

A list of the programs that have been run from the Run command is shown. Each time you use a command that has already been stored, it moves to the top of the list.

User assist

Key 🔑: NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Assist.

List of progs and applets that can be quicly started from the Start menu for usability, the most often used items. Shows a focus count for each entry. It means, how many time was the window switched to (that doesn’t include the time when the program is first run). Shows the last time that the program was executed, focus time, run count.

At the start of each entry between {} is the code for a location within file system. Registry Explorer will substitute these automatically, since these GUIDs are predefined.

This what a full filled User Assist key looks like. {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} is for programs that were lauched using their image files directly. {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} is for those, started with a shortcut.

The structure is quite simple:

• At 0x04 offset starts the number of executions (4 bytes).
• At 0xC offset starts the focus time (4 bytes)
• At 0x3C offset starts the Last Execution time (8 bytes), which is a Win64-bit little-endian value (for Decode 🛠).

⚠️ 🔎 I could not find this key on my Win10 VM.

⚠️ When the program was started via lnk file, the focus count will be 0.

Uninstalled applications

Key 🔑: Microsoft\Windows\CurrentVersion\Uninstall