It is no coincidence that a friend showed me a very interesting way to find out a detailed list of programs that were launched in the Windows operating system! To be honest, I didn't even know about it. And already once it helped me a lot!
Well, now let's continue on the topic - information about the programs that were launched is in the Amcache.hve system registry branch (who knew that there was one? I didn’t know before).
It is located along the path \ Windows \ AppCompat \ Programs \ Amcache.hve
How to copy a file on a live system - read forum.
It is suggested to analyze the file using the RegRipper utility described earlier from the previous article. I'll show you a couple of examples.
A couple of examples (one)
In the output file we see the path to the executable file, the start time (apparently this is it, in UTC) and, what is most delicious, the SHA1-hash of the executable file, which allows you to find it in the VirusTotal database. This is especially true if it is a previously known malicious file that has been renamed (for example, some kind of exploit like mimikatz).
And here is the result of a search by hash .. At least it is a little clear what it is. And then on the file path in Amcache, nothing at all can be understood.
By the way, don't look that the hash is different. VirusTotal automatically recalculates for a different algorithm, and can also search for SHA1.
In this way, you can investigate the history of the infection and the attachment of the attacker to the infected or compromised machine. Very comfortably!
Well, now let's continue on the topic - information about the programs that were launched is in the Amcache.hve system registry branch (who knew that there was one? I didn’t know before).
It is located along the path \ Windows \ AppCompat \ Programs \ Amcache.hve
How to copy a file on a live system - read forum.
It is suggested to analyze the file using the RegRipper utility described earlier from the previous article. I'll show you a couple of examples.
A couple of examples (one)
- Downloading the RegRipper program from GitHub;
- Download the Amcache.hve registry file (see above);
- Run rip.exe with the “amcache” plugin specified:
Code:
rip -r .. \ reg \ Amcache.hve -p amcache> amcache.txtIn the output file we see the path to the executable file, the start time (apparently this is it, in UTC) and, what is most delicious, the SHA1-hash of the executable file, which allows you to find it in the VirusTotal database. This is especially true if it is a previously known malicious file that has been renamed (for example, some kind of exploit like mimikatz).
And here is the result of a search by hash .. At least it is a little clear what it is. And then on the file path in Amcache, nothing at all can be understood.
By the way, don't look that the hash is different. VirusTotal automatically recalculates for a different algorithm, and can also search for SHA1.
In this way, you can investigate the history of the infection and the attachment of the attacker to the infected or compromised machine. Very comfortably!
