Windows prefetch trojan

It takes as a parameter a prefetch file to analyze. CQPreferchParser shows all the paths that were related to that particular prefetch file, as well as modules, the different types of DLLs that were loaded when this particular executable was running. Additionally, you can see a part of the execution history , for example like how many times notepad. CQPrefetchParser is a great tool to support us in a prefetch analysis while performing forensics , but it can itself be deleted if an attacker has administrative privileges to that computer.

So, remember that you may have to use some audit tools to eventually recover prefetch files in order to analyze them in the future. Take this chance to grow your skills in Azure AD security, digital forensics, shadow credential injection attacks, and Privileged Access Workstations. It creates the registry so that it runs each time you start your PC. For example:. Stops and deletes the following services. Before installing itself, it stops and deletes any the following services to terminate any instance or previous versions which may be running on your PC:.

This behavior also indicates that it can update an existing version of the threat on the infected machine. Blocks ports and allows certain files in the firewall. To do so, this threat issues any of the following commands:. It can also add Firewall rules to allow connections done by certain files:.

Runs a coin miner executable. See an example of the coin miner executable command below:. Connects to a remote host. We have seen this threat connect to any of the following remote hosts:.

It connects to a remote host to do any of the following:. Take these steps to help prevent infection on your PC. The following can indicate that you have this threat on your PC :. Send us feedback.

Tell us about your experience. Published May 03, Updated Sep 15, Learn about other threats. Summary Microsoft Defender Antivirus detects and removes this threat. What to do now Use the following free Microsoft software to detect and remove this threat: Microsoft Defender Antivirus for Windows 8.

I suggest you play around with both and see which one suits you better. As a summary, Prefetch files are good source of evidence to determine the existence and execution of suspicious executables on a system. However, it is just one of the many Windows forensic artifacts that can help investigators understand what a user was doing on a system at a specific point in time.

As a best practice, all Windows forensic artifacts should be examined and pieced together to see the bigger picture of an incident. This site uses Akismet to reduce spam. Learn how your comment data is processed. Skip to content.

This will allow system executables like dllhost. Forensic Value of Prefetch Files Simply put, Prefetch files are used to determine what programs were recently executed on a system.

If a program has since been deleted, a Prefetch file may still exist to provide evidence of previous existence and execution. Combining this with some basic timeline analysis, forensic investigators can identify any additional malware component that were downloaded on a system.

Demonstration Now to demonstrate the forensic value of Prefetch files, I will execute a malware sample in a Windows 10 virtual machine.

Thanks for reading and I hope you learned something new today! Like this: Like Loading Leave a Reply Cancel reply. Loading Comments