About Download userassist
By •January 10, 2019•Daily Blogforensic lunchtest kitchenuserassistwindows 10•Hello Reader, Tonight I changed the course of our testing in a slight detour, ok maybe a hard right, over to Windows 10 because I remembered an artifact that has been bugging me. The UserAssist artifact that has been a friend of mine since 2002 (I wrote about it in 2004 in the first hacking exposed computer forensics) seems to have had a change in behavior starting in Windows 8. Suddenly we had values showing up in the UserAssist with a run count of 0 and no last execution time. So to remedy this I decided to start some testing and here is what we learned:Running a Modern app will update the run count and the execution timeRunning a desktop app will update the run count and the execution timeThe focus count is still unreliableThe focus time is still unreliableRebooting does not zero out the values in the UserAssist keysSome entries in the UserAssist CEBFF guid specifically appear to not get updated as other versions of the same program do (process hacker in this example)Some things don't get updated run counts or execution times, so far Microsoft Edge and Cortana appear to behave that wayMore testing is needed so we can determine what is effecting the expected behavior.You can watch the video here:Also Read: Daily Blog #592
Key features of the Download userassist that are enabled through these drivers include:
- userassist-parser/README.md at main - GitHub
- The Windows Forensic Journey UserAssist - Medium
- UserAssist Analizi Muhammed AYG N
- Investigating UserAssist: A Guide for Cybersecurity Analysts
- Timestamps of UserAssist and Prefetch Execution Time
- UserAssist Execution History Dependencies - Tenable
- UserAssistView - Decrypt and Displays List of UserAssist
This EnScript is designed to decode data stored in the HKCU Registry UserAssist sub-key present in Windows XP and later operating systems.This key monitors application usage so as to enable the system to populate each user's start menu with frequently used applications.The UserAssist key will contain one or more sub-keys each with a name that is a GUID. Contained within each of those keys is a sub-key called Count; the entries themselves are contained therein.The name of each UserAssist entry is ROT13 encoded. Beta versions of Windows 7 used the Vigenère cipher but the final release of the operating system reverted to ROT13. Vigenère is not supported by this script.The entries that are of significance to the examiner are 16 bytes in length for operating systems prior to Windows 7 and 72 bytes in length for Windows 7 and later.16-byte entries contain run-count and session-count variables, also a last-executed date/time stamp. The run-count variable is stored as 5 greater than the actual value so a stored value of 6 would represent an actual run-count of 1. A run-count of 0 is believed to be a special value used to prevent an application being shown in the start menu. The examiner may also encounter negative values but the significance of these is not currently known.72-byte values were introduced with Windows 7. Not everything is known about these values but reverse engineering indicates the following -The session-count is no longer stored and the run-count is stored as is (it is not incremented by 5); the last-executed date/time stamp is still present.In addition to this, two additional variables are stored. These are a focus-counter and a focus-timer. The significance of the remaining bytes is unknown.When an application is executed the run-counter is incremented by one. The system then tracks the time that the
