Windows Prefetching
Introduction
Prefetching is a Windows memory management process in which the operating system pre-loads resources from disk into memory as a means of speeding up the loading time for applications. As part of its process, a .pf file is created in the C:\Windows\Prefetch directory and updated each subsequent time the application is executed.
The .pf file contains a list of resources, including files and directories that the executable referenced during execution, which is used to pre-load those resources the next time the application is executed.
What is the use of Prefetch Files?
These files are used to study the behavior of the Application means which application executes automatically or not etc
Prefetch files can be used for forensic analysis of the particular Application.
Analysis of the viruses can be studied with the help of prefetch files.
Prefetch file properties
Prefetch files are enabled by default on all Windows operating systems.
Prefetch, however, is disabled by default on Windows server operating systems and can be enabled through the registry.
In every windows OS there's a limitation of prefetch files
Windows XP
128
Windows 7
128
Windows 8
1024
Windows 10
1024
Prefetch configuration from the Registry
Prefetch can be configured from the registry. The path of the prefetch configuration in the registry is:
“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters”
Prefetcher is enabled and the data value is 3. You can change the configuration of prefetcher by changing the data value.
There are 4 values to enable prefetcher:
3
Enable Prefetcher for application startup and Boot
2
Enables Boot prefetching
1
Enables Prefetcher for application startup
0
Disables Prefetcher
How Investigators Use Prefetch File Contents
The prefetch file, while not intended for analysis, can provide a wealth of information for an investigator. When opened, a prefetch file can show:
Creation date – timestamped with the local time of the machine
Date/time of last execution time – timestamped with the local time of the machine
Run count – the number of times the executable has been launched
Other run times – limited to the previous eight (8) executions
Directories and files referenced – includes other executables
Volumes and file paths – the location from which files were accessed
Example walkthrough
This is one of the question from sherlock (campfire-1)
What is the full path of the tool used to perform the actual kerberoasting attack?
Given the prefetch folder we are going to find the tool is used for the attacking, and the full path of the files
We are using this PECmd.exe to perform the tasks.
PECmd.exe -d prefetch --csv . --csvf prefetch.csvpointing the directory to prefetch folders and process them output it in csv format
Scrolling abit we found the tool to be Rubeus.exe .
To individually analyse the file we can directly parse the file to Pecmd.exe
PECmd.exe -f prefetch\RUBEUS.EXE-5873E24B.pf
When was the tool executed to dump credentials?
Since we know the attacker uses Rubeus.exe
Pecmd also provides the timestamp of the application is executed
Author
Ik0nw
Interview Question
1) What is prefetch files?
2) Does Windows Server enable prefetching by default?
3) What is the maximum prefetch file for windows 11?
Last updated