Hello and welcome back to Windows Registry Forensic,
Course 6, the file system.
We are going to look at
AppCompatCache and background activities monitor,
otherwise known as BAM in this section.
What we're looking at here is
program installation and execution and
the two subkeys that we're going to
cover like I said, are AppCompatCache.
The path for that is going to be in
the system file, CurrentControlSet\Control,
SessionsManager,
AppCompatCache, and then AppCompatCache again.
This was created by Microsoft to identify
application compatibility issues to help
developers troubleshoot and
identify compatibility issues.
This way, 32-bit programs can run on a 64-bit system.
The cache data tracks the file path,
the size of the file,
the last modified time of the file,
and it is written at shutdown.
It doesn't get written to the system hive to
this key until the computer is shut down.
One of the caveats to AppCompatCache is
it only logs specific file extensions.
It's pretty much slugging executables,
backfiles, DLL files, programs and applications.
This is a place you would
want to look for malware being installed.
A file being listed here does not
prove file execution but it
can be a great source of evidence of
deleted files because if somebody
uninstall or deletes an application,
it is not going to be removed from the AppCompatCache.
We can see applications that were
previously installed on the computer.
You can also see
malware that may have been installed on the computer.
If you're an incident responder,
this is definitely a place you
want to go ahead and take a look.
The other subkey we're going to look at is BAM,
otherwise known as the Background Activities Monitor.
The location for BAM is in the current control set,
in this case is Control Set 1 Services
and then the BAM subkey.
Now what BAM does,
it keeps track of what is running in the background,
controls activity of the background applications.
The service exists in Windows 10 only.
It is by user SID.
When we look at it, you'll get to see that it is
organized by the user SID.
One of the subkeys under BAM is a user SID.
We can see a list with file paths in the executables,
in the execution times and we can
link these back to a specific user.
This list does also include Windows apps,
but they don't parse very
well and you'll see what I mean when we look at them.
The value again, we're going to get
that last executed file time.
If we look at it in hex,
it is a 64-bit little endian date and
file time format and BAM does prove
program execution and it does
tie back to a specific user.
That's going to be very useful
to us in our investigations.
These two subkeys used
in conjunction with each other and looked at in
a timeline fashion are very useful to seeing what was
going on in the computer and what
a particular user was accessing.
The tools we're going to need for our walk-through.
We're going to need Timeline Explorer,
we're going to need Registry Explorer,
and we're going to need the Ivan System Hive
that we exported from our Windows 10 image.
The first thing we're going to do is go
ahead and bring up Registry Explorer.
We're going to load Ivan's system hive.
If you haven't already done that or have
it from the last time we did it,
go ahead and load it.
Again, it's file, load hive,
navigate to where you saved the hive and click "Open".
The first key we're going to look
at is the AppCompatCache.
We can use the bookmarks for this one.
You go up to Bookmark CommonAppCompatCache
and here we can see the AppCompatCache.
Now if we double-click on
that key over here in the values under
the value name double-click on AppCompatCache,
so we can view the file.
Here we can see the cache entries.
The latest entries should be on top.
The cache is supposed to push
down as a new entry is added.
We can also see this date and time modified.
Now this applies to when
the application was either installed,
updated, or modified in some way.
It does not indicate
that the file was executed at this date and time.
I just want you to understand that.
Again, we see we can export this.
Go ahead and do that.
You'd click "Export" and
then choose where you wanted to save it.
You can see here they're all executable programs,
or bin files, or data files or DLL files.
Again, this is for application compatibility.
Like I said, those Windows applications,
as you can see right here,
don't parse very well.
Those Microsoft built-in apps
they are listed and you can tell what the application is.
But as far as a date and time,
we're really not going to get that.
You do want to look for malware here.
Look for odd file paths, like Temp.
Look for filenames that are just misspelled alittle,
this can be an indication of malware.
A lot of this stuff you would expect to
see coming from System32,
coming from WoW64, coming from Program Files,
so you want to keep a lookout for
some odd file paths as you go through here and look.
Now, let's take a look at this in Timeline Explorer.
Bring up Timeline Explorer,
go ahead and load the file in that you exported.
You would click "Open",
and then navigate to where you
save that file and load it.
Again, we see pretty much the same data we were able to
see within Registry Explorer,
but it's a little easier to read this way.
You can sort on the columns,
you can sort on cache entry,
you can sort on modified,
you can sort on program name,
and it will move them around.
To see Registry Viewer in here, disk decryptor.
Again, you're going to see a lot of system
while 64 and system 32,
you would expect to see that file path,
that would not be a strange one.
Things going to temp in
other places could be
an issue or an indication of malware.
So you do want to take a good look through here.
We can see PING and ARP being executed,
Metasploit is on this list.
But you can scroll through here and see what you can find
for applications that look like
they shouldn't be on the computer.
Maybe it's an application that
the user or the suspect said they
didn't have installed on their computer.
Maybe it's something they're not allowed to
have installed in the workplace,
like a keylogger or something of that nature.
But again, remember, this does
not prove program execution.
It just proves that the program was installed
on the system and you do have
that modified time which will give you
the install time or
the time that it was updated or changed.
Now, let's go back to
Registry Explorer and let's look at BAM,
the Background Activities Monitor.
If we want to look at BAM,
we're simply going to go to
our Control Set 1 or current control set,
we only have one on this computer.
We're going to go to Services.
From Services, we're going to scroll
down and find the BAM key,
B-A-M. We're going to expand the key.
Underneath the key, you can see we have sits and rids.
We talked about this when we covered the SAM file.
The one we're going to be interested in is 1001
which if you remember was Ivan's rid.
We're going to click on that and we're going to see
what programs Ivan has executed.
As we look through the programs Ivan's executed,
we can see the execution time.
Again, you can go ahead and sort on execution time.
We can see the most recent programs that were executed.
We can scroll down and see
the remainder of the programs that were executed.
Again, I want you to note you have the Export button,
go ahead and export this.
Save it somewhere out on
your file system where you can get to it,
and we're going to bring up Timeline Explorer again.
This time, we're going to look at the BAM exported files.
Now, what's nice about this is you can locate a file in
one list and see if we can find
a date and timestamp for when it was last executed.
If we wanted to look at explorer.exe,
we could go back to app compact cache
and we could look for explorer.exe.
One of the easier ways to find it is
going to be to search and we
see internetexplorer.exe and windowsexplorer.exe.
Those, we know, are two different things.
Go back to BAM and we're looking
at volume 2 windowsexplorer.exe,
and we can see when the last time it was executed.
That's most likely the Windows Explorer,
not Internet Explorer.
If you find something in app compact cache
that's interesting to you,
you can go ahead and see if you can find
its execution date in
the background activities monitor, BAM.
Again, this is logging
or keeping track of
files that are running in the background.
We can see Registry Explorer and FTK imager here too.
You might want to go back and see if
those are in your app compact cache.
If we look at app compact cash,
we see a program like Wireshark.
If you were curious,
I don't think Wireshark is here,
but you can take a look and see if it is.
Now, remember, this is
a virtual machine and I did not run a whole lot on it.
So we do not see Wireshark is
running in the background on the Ivan machine.
But every program here,
we have an execution date and time,
when this is last executed,
and it ties back to
an individual user because it's by user rid.
This could be a very important artifact
and definitely something you want
to have in your timeline
when you're doing an investigation.
One more thing, go ahead and minimize Timeline Explorer.
I just want to make you
aware that when we look at values,
we're seeing the same data,
we're just seeing more of a binary view of it.
Again, if we wanted to decode this date and time,
it's going to be these eight bytes,
and the file time format is 64-bit little-endian.
We could use decode and decode the value.
The file time is 64-bit little-endian,
and when we decode it,
we get our dates and times.
In the next section,
we're going to look at the
userclass.hive and some of
the artifacts we can find in there.