GCFA Windows Artifact Analysis — Timed 10 Questions

Question 1

An analyst discovers a suspicious executable in a user's AppData folder. Which Windows artifact should be examined first to determine if the file was executed via a specific user action or a scheduled task?

10 minute time limit — choose an answer to begin.

Accepted Answer

UserAssist. UserAssist tracks GUI-based application execution, while Prefetch provides execution history regardless of the launch method. To differentiate between user-driven execution and background tasks, an analyst must correlate UserAssist entries with the Task Scheduler logs or Prefetch files. Understanding the launch vector is critical to determining if the activity was manual interaction or automated persistence, which guides the subsequent scope of the investigation into potential lateral movement or malicious automation.

Answer

ShimCache (AppCompatCache)

Answer

Amcache.hve

Answer

SRUM (System Resource Usage Monitor)

Question 2

Which TWO of the following artifacts are most effective for identifying file system activity that occurred immediately before a system shutdown or sudden crash?

Accepted Answer

ShellBags. Analyzing recent file activity requires artifacts that persist across volatile states. The Registry's ShellBags preserve folder view settings, and the RecentDocs key tracks items accessed through the Windows shell. By examining these, analysts can reconstruct the final user actions before a loss of power or system crash. This is vital for incidents involving anti-forensics or attempts to hide evidence by inducing a system failure to prevent proper log flushing.

Answer

Event Log 7040

Answer

SAM Hive

Answer

System Resource Usage Monitor (SRUM)

Question 3

Refer to the exhibit. Based on the USN Journal output, what can the analyst conclude about the file 'secret_data.docx'?

Accepted Answer

The file was created and modified by the user at 14:22:05.. The USN Journal logs low-level modifications to the NTFS volume. The presence of 'FileCreate' followed by 'DataOverwrite' and 'Close' indicates the file was generated and then modified within the same timeframe. This allows an analyst to build a precise sequence of events for a specific file. Understanding these flags is critical for proving data staging or exfiltration activities when other high-level application logs may have been wiped by the adversary.

Answer

The file was deleted immediately after being created.

Answer

The file was moved from a different volume.

Answer

The file is currently open by an active process.

Question 4

An analyst is investigating a compromised system and finds that the 'LastWrite' time of a specific registry key has been modified to match the surrounding keys. Which artifact should be checked to detect this timestomping attempt?

Accepted Answer

USN Journal. Registry keys do not maintain a comprehensive history of modification times, making them vulnerable to timestomping. However, the Transaction Logs (hive transaction files) and the USN Journal record low-level file system and registry transactions. By comparing the high-level registry timestamps with the low-level journal entries, an analyst can detect discrepancies. This is essential for uncovering sophisticated attackers who attempt to blend in by falsifying temporal evidence during a post-exploitation phase.

Answer

Prefetch files

Answer

Windows Event Logs

Answer

ShimCache

Question 5

Which THREE pieces of information can be extracted from a parsed Windows 'Jump List' artifact?

Accepted Answer

The full path of the accessed file. Jump Lists are essential for understanding user interaction with specific applications. They record recently accessed files, pinned items, and the application ID associated with those objects. By analyzing these, an analyst can determine if a user opened sensitive documents or used specific tools, providing a window into their recent workflow. This artifact is a primary target for evidence of data exfiltration, as it captures the file paths and access times of opened documents.

Answer

The user's password hash

Answer

The system's BIOS version

Question 6

An analyst is investigating an unauthorized remote connection. Which artifact, located in the SYSTEM hive, provides evidence of network interface configuration changes that might indicate an attacker-controlled VPN or bridge?

Accepted Answer

NetworkList Key. The Windows registry maintains a detailed history of network configuration in the 'NetworkList' key. Changes here can signify the introduction of new network adapters or VPN configurations that could facilitate unauthorized remote access. Detecting these changes is crucial for understanding how an attacker maintained persistence or bypassed network security controls, as it provides a clear temporal record of when the network environment was modified to support their malicious activity.

Answer

Software Hive (Services)

Answer

SAM Hive

Answer

Amcache.hve

Question 7

Refer to the exhibit. An attacker modified the SpecialPollInterval value. What is the primary forensic implication of this change on a compromised system?

Accepted Answer

The system clock accuracy is compromised for log correlation.. Modifying the NTP poll interval is a common technique used by attackers to de-synchronize the system clock or force frequent synchronization, which can interfere with the accuracy of log timestamps. Forensic integrity relies on accurate timekeeping for timeline analysis. If an attacker tampers with time synchronization, they can effectively hide their activity by shifting the perceived time of events, potentially invalidating evidence or causing correlation failures across logs.

Answer

The system will automatically reboot every hour.

Answer

The registry key change triggers a System Audit log.

Answer

The system will be unable to connect to the domain.

Question 8

Which THREE artifacts are essential for identifying the presence and execution of 'Living off the Land' (LotL) binaries like PowerShell or WMI on a Windows host?

Accepted Answer

Prefetch files. LotL attacks utilize trusted system tools to perform malicious actions, making them difficult to detect. Prefetch files capture command-line arguments for executed processes, while the Security Event Logs (specifically 4688) provide detailed process creation events. Finally, the Amcache.hve can provide metadata about the versions of these binaries. Together, these sources allow an analyst to prove that a legitimate tool was used in an illegitimate way, which is central to most modern incident response cases.

Answer

SAM Hive

Answer

Software Hive

Question 9

Refer to the exhibit. What is the significance of the 'LastWrite' time for this specific registry key?

Accepted Answer

It represents the first time the device was connected.. The LastWrite time on an Enum key in the SYSTEM hive indicates when the device was first installed or when its configuration was last updated. This provides a temporal anchor for the device's introduction to the system. Understanding this is critical for scoping the window of opportunity during which data could have been exfiltrated, especially when combined with other artifacts that show user file system activity after this connection timestamp.

Answer

It shows when the file 'Cruzer_Glide' was last run.

Answer

It indicates the time the device was safely removed.

Answer

It confirms that the user deleted the device driver.

Question 10

When reviewing 'ShimCache' (AppCompatCache), what does an entry with an empty 'Last Modified' time suggest to an investigator?

Accepted Answer

The file was executed but not properly cached.. ShimCache is a memory-resident structure that is written to the SYSTEM hive upon system shutdown. An entry with an empty or null 'Last Modified' time often indicates that the file was executed, but the system did not complete a clean shutdown, or the entry was part of a memory-only process that never successfully committed its metadata to the hive. This is a critical indicator of potential system instability or a forced power-off event.

Answer

The file was executed from a network share.

Answer

The file is a system binary protected by Windows.

Answer

The file was recently deleted from the system.