Lab 9.2 — Disk Artifact Analysis

Lab Overview

The Scenario

Following the evidence collection in Lab 9.1, the endpoint (WIN-ENDPOINT-01) has been isolated. Your task is now to analyze the disk artifacts that record program execution history. The attacker used several tools during the compromise — some were deleted, but the execution artifacts remain.

Your goal: determine what programs ran, when they ran, and how many times — then identify the malicious tools.

Part 1: Understanding Windows Execution Artifacts

The Three Pillars of Execution Evidence

Windows maintains three independent artifact sources that record program execution:

Click to enlarge

Part 2: Prefetch Analysis

What Prefetch Tells You

Every time a program executes on Windows, the OS creates (or updates) a Prefetch file in C:\Windows\Prefetch\. Each file records:

• Executable name and path
• Last 8 execution timestamps (Windows 10+)
• Run count (total number of executions)
• Files and directories accessed during execution

Collecting Prefetch with Velociraptor

1. Open the Velociraptor Web UI and select WIN-ENDPOINT-01
2. Navigate to Collected Artifacts → New Collection
3. Search for and select: Windows.Forensics.Prefetch
4. Launch the collection

Analyzing the Results

When the collection completes, examine the results table. For each entry, note:

PREFETCH ANALYSIS LOG
═════════════════════
Executable         | Run Count | Last Executed      | Path                    | Suspicious?
-------------------|-----------|--------------------|--------------------------|-----------
[name].exe         | [count]   | [timestamp UTC]    | [full path]             | [Y/N + reason]

What to look for:

• Executables with names mimicking system processes (e.g., svch0st.exe, csrs.exe)
• Tools commonly used by attackers: mimikatz.exe, psexec.exe, procdump.exe, nc.exe, whoami.exe
• Programs executed from unusual paths: C:\Temp\, C:\Users\Public\, Downloads\
• High run counts on suspicious executables (indicates repeated use)
• Execution timestamps that cluster during off-hours

Part 3: Amcache Analysis

What Amcache Tells You

The Amcache registry hive tracks application compatibility data. For forensics, it provides:

• SHA1 hash of the executable (critical for malware identification)
• Full file path where the program was located
• First execution timestamp
• File size and publisher information

Collecting Amcache with Velociraptor

1. Create a new collection
2. Select: Windows.Detection.Amcache
3. Launch the collection

Analyzing the Results

Cross-reference Amcache entries with your Prefetch findings:

AMCACHE ANALYSIS LOG
═════════════════════
Executable  | SHA1 Hash        | Full Path              | First Run          | Publisher
------------|------------------|------------------------|--------------------|----------
[name].exe  | [sha1]           | [path]                 | [timestamp UTC]    | [publisher or UNKNOWN]

Key analysis steps:

1. Hash lookup: Take SHA1 hashes of suspicious executables and search VirusTotal or your threat intel platform
2. Publisher check: Legitimate software has publisher information; attacker tools usually show UNKNOWN
3. Path correlation: Match Amcache paths with Prefetch paths — same executable, same location?
4. Timeline correlation: Compare Amcache "first run" with Prefetch "last run" to determine the activity window

Part 4: ShimCache Analysis

What ShimCache Tells You

The Application Compatibility Cache (ShimCache) records:

• File path of executed programs
• Last modification timestamp of the executable file
• Execution flag (whether the program actually ran, not just existed)

ShimCache is written to the registry on system shutdown, which means it captures a snapshot of execution activity for the entire session.

Collecting ShimCache with Velociraptor

1. Create a new collection
2. Select: Windows.Registry.AppCompatCache
3. Launch the collection

Analyzing the Results

SHIMCACHE ANALYSIS LOG
══════════════════════
Position | Executable Path                          | Modified Time      | Executed?
---------|------------------------------------------|--------------------|----------
[pos]    | [full path]                              | [timestamp UTC]    | [Yes/No]

Important ShimCache behaviors:

• Entries are ordered by most recent first (position 0 = last executed)
• The "modified time" is the file's last modification timestamp, NOT the execution time
• ShimCache can record files that were merely accessed (not executed) on some Windows versions

Part 5: Building the Execution Timeline

Correlating All Three Sources

Now combine your findings from Prefetch, Amcache, and ShimCache into a unified timeline:

Click to enlarge

UNIFIED EXECUTION TIMELINE
═══════════════════════════
Time (UTC)          | Executable        | Source(s)              | Action
--------------------|-------------------|------------------------|-------
[earliest timestamp]| [name].exe        | Amcache (first run)    | Initial execution
[next timestamp]    | [name].exe        | Prefetch (run #1)      | First prefetch record
[...]               | [...]             | [...]                  | [...]
[latest timestamp]  | [name].exe        | Prefetch (last run)    | Most recent execution

Identifying the Malicious Tools

Based on your analysis, answer these questions:

1. Which executables appear in ALL THREE artifact sources? (highest confidence of execution)
2. Which executables have SHA1 hashes that match known malware? (Amcache)
3. Which executables ran from non-standard paths? (all three sources)
4. What is the chronological order of the attacker's tool usage?
5. Are there any executables in ShimCache that are NOT in Prefetch? (may indicate anti-forensic cleanup of Prefetch)

Part 6: Documenting Your Findings

Create Your Artifact Analysis Report

DISK ARTIFACT ANALYSIS REPORT
══════════════════════════════
Case ID:     IR-2026-[today's date]
Examiner:    [your name]
Endpoint:    WIN-ENDPOINT-01
Date:        [UTC timestamp]

EXECUTIVE SUMMARY
─────────────────
[2-3 sentences: what happened, based on artifact evidence]

MALICIOUS EXECUTABLES IDENTIFIED
────────────────────────────────
1. [name].exe
   - Path: [full path]
   - SHA1: [hash from Amcache]
   - Run Count: [from Prefetch]
   - First Seen: [from Amcache]
   - Last Seen: [from Prefetch]
   - Classification: [attacker tool / malware / unknown]

EXECUTION TIMELINE
──────────────────
[Your unified timeline from Part 5]

ARTIFACTS ANALYZED
──────────────────
- Prefetch files: [count] entries analyzed
- Amcache entries: [count] entries analyzed
- ShimCache entries: [count] entries analyzed

Deliverable Checklist

Before completing the lab, ensure you have:

• Prefetch Analysis Log — all suspicious executables with run counts and timestamps
• Amcache Analysis Log — SHA1 hashes, paths, and first execution times
• ShimCache Analysis Log — execution flags and modification timestamps
• Unified Execution Timeline — chronological correlation of all three artifact sources
• Malicious Tool Identification — at least 2 attacker tools identified with evidence from multiple sources
• Artifact Analysis Report — formal report with executive summary and findings

What's Next

In Lab 9.3 — Windows Forensic Investigation, you'll expand beyond execution artifacts to conduct a full Windows investigation: registry analysis, user activity timelines, browser artifacts, and USB history. You'll build a complete attack narrative from the evidence.