Pecmd exe ошибка приложения

Страница 1 из 27

pecmd.exe is part of PECMD and developed by DSystem according to the pecmd.exe version information.

pecmd.exe’s description is «WinPE Commander (Modified By DSystem mdyblog.blog.163.com)«

pecmd.exe is usually located in the ‘X:WindowsSystem32’ folder.

Some of the anti-virus scanners at VirusTotal detected pecmd.exe.

If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.

VirusTotal report

1 of the 71 anti-virus programs at VirusTotal detected the pecmd.exe file. That’s a 1% detection rate.

Sandbox Report

The following information was gathered by executing the file inside Cuckoo Sandbox.

Summary

Successfully executed process in sandbox.

Generic

[
    {
        "process_path": "C:\Users\cuck\AppData\Local\Temp\a38065dfe54348762c35f4ed1381b54ed08d3110ac2be695f8f8c2730779d6f6.bin",
        "process_name": "a38065dfe54348762c35f4ed1381b54ed08d3110ac2be695f8f8c2730779d6f6.bin",
        "pid": 2420,
        "summary": {},
        "first_seen": 1576079588.578125,
        "ppid": 2448
    },
    {
        "process_path": "C:\Windows\System32\lsass.exe",
        "process_name": "lsass.exe",
        "pid": 476,
        "summary": {},
        "first_seen": 1576079588.328125,
        "ppid": 376
    }
]

Signatures

[
    {
        "markcount": 1,
        "families": [],
        "description": "One or more processes crashed",
        "severity": 1,
        "marks": [
            {
                "call": {
                    "category": "__notification__",
                    "status": 1,
                    "stacktrace": [],
                    "raw": [
                        "stacktrace"
                    ],
                    "api": "__exception__",
                    "return_value": 0,
                    "arguments": {
                        "stacktrace": "RntnlnCnanpntnunrnenCnonnntnenxntn+n0nxn8n5n nRntnlnRnensntnonrnenCnonnntnenxntn-n0nxnanan nnntndnlnln+n0nxn5n0n8n9n5n n@n n0nxn7n7nan0n0n8n9n5nnnsntnancnkntnrnancnen+n0nxn8n4n nmnenmndnunpn-n0nxn1nanfn n@n n0nxn6n5nan8ncn4n0ndnnnhnononkn_ninnn_nmnonnnintnonrn+n0nxn4n5n nlndnen-n0nxn1n3n3n n@n n0nxn6n5nan8n1nbn2nannnNnenwn_nnntndnlnln_nNntnPnrnontnencntnVninrntnunanlnMnenmnonrnyn+n0nxn3n4n nNnenwn_nnntndnlnln_nNntnQnunenrnynAntntnrninbnuntnensnFninlnen-n0nxn1n5n1n n@n n0nxn6n5nanan3n4nbndnnnVninrntnunanlnPnrnontnencntnEnxn+n0nxn3n3n nMnanpnVninenwnOnfnFninlnen-n0nxn2ndn nknenrnnnenlnbnansnen+n0nxn1n3n2n4n3n n@n n0nxn7nfnenfndnan2n3n2n4n3nnnVninrntnunanlnPnrnontnencntn+n0nxn1nbn nVninrntnunanlnPnrnontnencntnEnxn-n0nxn1n5n nknenrnnnenlnbnansnen+n0nxn1n3n1nfnbn n@n n0nxn7nfnenfndnan2n3n1nfnbnnnLnonandnEnnnvnin+n0nxn2ncnendn5n nan3n8n0n6n5ndnfnen5n4n3n4n8n7n6n2ncn3n5nfn4nendn1n3n8n1nbn5n4nendn0n8ndn3n1n1n0nancn2nbnen6n9n5nfn8nfn8ncn2n7n3n0n7n7n9ndn6nfn6n+n0nxncnfncnen1n n@n n0nxn1n4n0n0ncnfncnen1nnnGnentnPnrnoncnensnsnAnfnfninnnintnynMnansnkn+n0nxn8n0n nSnentnTnhnrnenandnCnonnntnenxntn-n0nxn2n0n nknenrnnnenln3n2n+n0nxn2nenfn0n n@n n0nxn7n7n7n9n2nenfn0nnn0nxn1n2nanfnfnfnnnGnentnPnrnoncnensnsnAnfnfninnnintnynMnansnkn+n0nxn8n0n nSnentnTnhnrnenandnCnonnntnenxntn-n0nxn2n0n nknenrnnnenln3n2n+n0nxn2nenfn0n n@n n0nxn7n7n7n9n2nenfn0nnnLnonandnEnnnvnin+n0nxn8n9n1nfn4n nan3n8n0n6n5ndnfnen5n4n3n4n8n7n6n2ncn3n5nfn4nendn1n3n8n1nbn5n4nendn0n8ndn3n1n1n0nancn2nbnen6n9n5nfn8nfn8ncn2n7n3n0n7n7n9ndn6nfn6n+n0nxn1n2ncn0n0n0n n@n n0nxn1n4n0n1n2ncn0n0n0nnnWnnndnPnrnoncn1n-n0nxn2n0n6n4n nan3n8n0n6n5ndnfnen5n4n3n4n8n7n6n2ncn3n5nfn4nendn1n3n8n1nbn5n4nendn0n8ndn3n1n1n0nancn2nbnen6n9n5nfn8nfn8ncn2n7n3n0n7n7n9ndn6nfn6n+n0nxn1n0n0n0n n@n n0nxn1n4n0n0n0n1n0n0n0nnn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0nennn0nxnfn4nbn0ne",
                        "registers": {
                            "r14": 0,
                            "r9": 4,
                            "rcx": 1242664,
                            "rsi": 5369937920,
                            "r10": 0,
                            "rbx": 2004430576,
                            "rdi": 5368709487,
                            "r11": 514,
                            "r8": 64,
                            "rdx": 1244008,
                            "rbp": 0,
                            "r15": 0,
                            "r12": 0,
                            "rsp": 1244968,
                            "rax": 1242344,
                            "r13": 0
                        },
                        "exception": {
                            "instruction_r": "0f ae 81 00 01 00 00 0f 29 81 a0 01 00 00 0f 29",
                            "symbol": "RtlCaptureContext+0x85 RtlRestoreContext-0xaa ntdll+0x50895",
                            "address": "0x77a00895",
                            "module": "ntdll.dll",
                            "exception_code": "0xc0000005",
                            "offset": 329877
                        }
                    },
                    "time": 1576079159.268396,
                    "tid": 2460,
                    "flags": {}
                },
                "pid": 2420,
                "type": "call",
                "cid": 2
            }
        ],
        "references": [],
        "name": "raises_exception"
    }
]

Yara

The Yara rules did not detect anything in the file.

Network

{
    "tls": [],
    "udp": [
        {
            "src": "192.168.56.101",
            "dst": "192.168.56.255",
            "offset": 546,
            "time": 3.0794410705566406,
            "dport": 137,
            "sport": 137
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3346,
            "time": 3.0154519081115723,
            "dport": 5355,
            "sport": 51001
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 3674,
            "time": 1.0325961112976074,
            "dport": 5355,
            "sport": 53595
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 4002,
            "time": 3.0243349075317383,
            "dport": 5355,
            "sport": 53848
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 4330,
            "time": 1.5361568927764893,
            "dport": 5355,
            "sport": 54255
        },
        {
            "src": "192.168.56.101",
            "dst": "224.0.0.252",
            "offset": 4658,
            "time": -0.0938420295715332,
            "dport": 5355,
            "sport": 55314
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 4986,
            "time": 1.5634279251098633,
            "dport": 1900,
            "sport": 1900
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 11456,
            "time": 1.066183090209961,
            "dport": 3702,
            "sport": 49152
        },
        {
            "src": "192.168.56.101",
            "dst": "239.255.255.250",
            "offset": 15648,
            "time": 3.140749931335449,
            "dport": 1900,
            "sport": 53598
        }
    ],
    "dns_servers": [],
    "http": [],
    "icmp": [],
    "smtp": [],
    "tcp": [],
    "smtp_ex": [],
    "mitm": [],
    "hosts": [],
    "pcap_sha256": "dc81f2906b45b1fe86ae4343cb281cd36ff85abfb3cc379fdd72c3227d9ae9bb",
    "dns": [],
    "http_ex": [],
    "domains": [],
    "dead_hosts": [],
    "sorted_pcap_sha256": "f1207c666c95dc109812d44512a394c2e1dc6102e955769c52ff97baf9d5fb5f",
    "irc": [],
    "https_ex": []
}

Screenshots

Error Messages

Malware or legitimate?

If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.

And now some shameless self promotion

OVERVIEW

Prefetch is a process or technique developed by the Windows operating system to maximize the performance and minimize wait times of an application to be loaded.

In general, prefetch automatically gets loaded with the application by caching required files and resources into memory which typically results in increasing the speed & minimizing the wait time. Prefetch is officially introduced by Microsoft and published at  Windows XP and introduced various different versions of the prefetch files to increase the stability & functions  of the prefetch files:

Some versions are :

• Windows XP and Windows 2003
• Vista and Windows 7
• Windows 8.1
• Windows 10

File location C:\Windowsprefetch [*Required administrator privilege]

On further we can observe File name followed by a random number which is the HASHING generated by prefetch used to determine the path from where the file was executed, Depending on the version of Windows the file was taken from, a different hashing function is used.

Also Read: How DKIM SPF & DMARC Work to Prevent Email Spoofing and Phishing

NOTE: Prefetch is enabled default on windows workstations not on windows servers

In addition the Maximum number of prefetch files which can be stored at Windows XP to Windows 7 =128 & Windows 8 to Windows 10=1024.

Forensic investigation with Prefetch files

Prefetch files are generally used to investigate the applications that have been executed on a system, hence these files contain sensitive data used to retrieve user’s application history on a computer which is used for forensic investigations, 

in most cases of cyber attacks, the attacker uses many malicious files to get executed on the victim system to gather sensitive information or to compromise the entire system, while the attacks take places its required multiple application to get executed,

While investigating the prefetch file we can determine the application which is accessed by the attackers on the targeted computer while compromising it, hence it is used to map or determine the activity of the attack execution.

The file consists of detailed information about the time when the file is created & accessed which are used to co-relate the activity happening on the victim system.

Also Read: Latest IOCs – Threat Actor URLs , IP’s & Malware Hashes

PECmd is an open-source CMD tool used to fetch all possible forensic artifacts from a prefetch file, 

Download → https://ericzimmerman.github.io/#!index.md

Note: The above-mentioned link is used to download PECmd.

Also Read: Most Common Windows Event IDs to Hunt – Mind Map

 PECmd.exe will retrieve the list of the following detail mentioned below

1. Created on [Display created date/time]
2. Modified on [Display modified date/time]
3. Last modified [Display last date/time]
4. Executable Name [Display extension date/time]
5. Hash [Display Prefetch hash]
6. File Size [Display File size in bytes]
7. Windows Version [Display OS version]
8. Run Count [Display total run count of the specific file in the system]
9. Other Run time [Display total date/time of top 7 count of the specific file in the system]
10. Volume information 
    1. Directories referenced [List of directories referenced]
    2. File referenced [List of files referenced] 

Also Read: Persistence Remote Password Reset – Event IDs to Monitor

Conclusion:

Prefetch analysis is used to investigate Windows forensics artifacts which help to investigate & understand the activity done by the user on a system at a particular time. It majorly helps to reveal the root cause of an attack and helps to uncover the bigger picture of an incident or investigation.