Hello, and welcome back to Windows registry forensics,
course 8 the AmCache hive file.
In this section, section 2, we're going to look at AmCache Parser.exe
command-line tool, and we're going to use it to parse Ivan's AmCache hive.
In this walkthrough, we're going to use AmCacheParse.exe.
We're going to need AmCache Parser.exe from Zimmerman tools.
If you haven't downloaded it yet, if you google Zimmerman tools,
you'll be able to find it.
We're also going to need Timeline Explorer, which we've used a couple times
before, but that can also be found out at Zimmerman tools and
we're going to need Ivan's AmCache file.
When we launch AmCache Parse.exe, we're going to be presented with this screen,
and it's going to tell us what some of our options are going to be.
If we want two, and if we have a file containing a list of
show one hashes for blacklisting, we can do that.
And this is a great function of this tool,
because you can put these known bad hashes into a hash file list.
And right from the AmCache Parser,
you can run it against all the hash values in your AmCache file.
So, you'll be presented with just a list of the files that are known bad.
You can also do the same thing with white listing, and this will exclude all
the known files, like all the Windows system files and things we really
don't need to look at if we're doing an incident response type of case.
And blacklisting will always override white listing.
Some of the options we're going to need to have in our command in order for
this program to work, is you have to have the minus F switch, and
the minus F switch is going to be the path to the file.
Where is the AmCache file?
So, we have to show it where the AmCache file is.
We also have to give it some type of directory to output to and
some type of file format to output to.
So, the minus minus CSV are going to be required.
So, you're going to have to specify a place where you're going to write
the files too and this writes out quite a few CSV files,
and you're going to have to specify what you're parsing.
So, you need what you're parsing and you need a destination.
I would also recommend using the- I switch,
because this is going to include all the file entries for program entries.
So you're going to see all these files entries for our programs, and
that's really useful.
So, let's go ahead and I'm going to start from the very beginning,
but I'm going to go ahead and clear screen and
I'm going to go ahead and change directories back to my roots.
If you want to change your route it's CD, space forward slash, and
now we're at the root of C.
Once I'm at the root of C or even from my users file, it doesn't really matter.
Now, I need to navigate to the directory where I downloaded and
extracted my AmCache Parse.exe.
The easiest way to do this, is in your Windows Explorer,
navigate out to the file, right click, copy its path and
then you can paste it into command line.
Remember, don't forget to put in the command CD, for change directory.
Once I put that in, I'm now in the folder where my AmCache Parse.exe resides.
From here, I want to go ahead and execute the AmCache Parse,
so I'm going to type in AmCache Parse.exe and hit enter.
And again we're going to be presented with what we saw earlier, all our options for
blacklisting, white listing, including the files and different types of CSV output.
If you put just .CSV, it's going to name it a certain way.
It has a certain naming convention and names it with the date and time and
you can see that.
If you want it named to override that and you want it named a certain way,
you can use CSV F, you can change the date and
time with the DT command to make a customized date and time.
There are a couple of other commands, but there's not really a lot you can do here,
you can ignore your transactions and dirty hives,
you can show debugging information and you can trace information during processing.
And it does give you some examples of how you would do these commands at the bottom.
And we talked about the white listing, for excluding those known files, and
the blacklisting, for including those bad files.
And this is extremely useful for incident response.
So, once we've navigated it here, and we've hit the AmCache Parse.exe,
go ahead and hit your up arrow it will bring back AmCache Parse.exe for us.
Now, we've got to tell it where our file is.
We use the minus F switch, and
we put in the file path to where the AmCache.hve file is saved out.
Now, we talked about wanting to use the minus I switch, so
I'm going to go ahead and do that.
So, I put in the minus I on, and now I have my CSV, it's my file format,
and now I have the file path without quote marks,
no quotations on this file path to where I want to export it to.
And I want to name it something different than the conventional
naming structure, so, I've chosen that naming convention.
So once you've got this all typed in, you can go ahead and hit enter.
[SOUND] And it works very quickly,
and we can see here that the total file entries found are 164,
total device containers found is 10, total PAP,
Plug And Play entries, 75, total drive binaries
found are 322, drive packages are two.
It found no an associated values.
An associated value is a program or application that is associated with
a known source, would be what it's going to call associated values.
Unassociated values are files or
applications that are not associated with a known source.
And again, if you're looking for bad files, that's probably
the first place you're going to want to look as those unassociated values.
We don't have any in this particular image,
I do have one example that I'm going to show you that I
put into timeline explorer, so you can just see what it looks like.
So, this went across 95 program entries and 0.2 65 seconds.
So, this is a pretty handy tool.
Now, let's go ahead and take a look at the output.
This is what our output is going to look like.
You're going to get several CSVs here, and
we're going to take a look at these in Timeline Explorer.
So once we bring up Timeline Explorer, you would go ahead to file, open, and
you can go ahead and open all these at once if you like,
you can do as a controller and open them all.
Let's take a look at associated files first.
And we see, it looks a lot like what we've looked at earlier, we have our program
name, we have our program, ID, we have our last right key, we have our show one.
We have our file paths to the executables, our file extension,
which is probably going to be executable or been for the most part, we've
got a product version and it will tell us whether or not it's a binary type file.
Next, looking AmCache device containers, and we looked at the sub key and
registry viewer, and looking at it here, we can see the same type of information.
We have our key name which is a quid, we do have our key last write time.
We have our categories, and these were the hardware devices that we looked at,
that were attached to the computer and installed.
We have the Fax printer PDF, microphone speakers, XPS document writer,
we do have an unknown here, it is a USB device but we do have an unknown,
and it does give you some categories you may or may not get a manufacturer.
We do have a model ID which is a quid,
which is searchable throughout the file system.
You may find hits elsewhere in the file system, we have a model name.
In the primary category, and you can see display monitors, audio, printers, faxes.
We do have that one known, but in the model name,
we can see it's an 80 USB flash drive.
Looking at the programs entry and we looked at the program sub key,
we do have our program ID, again, a key last write time, again,
we have the name of the program or application.
We have a version, we have a publisher, where did it come from?
Is it the publisher?
Is it Microsoft, or rapid seven, Google?
We have an installed eight, when was it installed on the system?
We have a version, now it's talking about the operating system version
when the program was installed.
So this is Windows 10 15,063, is the version.
Does it have anything hidden?
Talks about the language, and then we have our Microsoft installer package cache,
package code, and those are quids.
Then we have our full name, we have something called a program instance ID,
which again you could search for that across your
image file using a tool like autopsy or whatever forensics you use.
It shows us the registry key path.
We don't have them for every single entry, but we saw how we did have that.
When we looked at it, where in the registry are we looking?
We have our root directory path,
which is going to show us where in the file system it resides.
Where is this executable?
Is it in system 32, program files, program files X 86?
It's going to show you the file path.
Now we have the source.
Where did it come from?
The Microsoft installer, APX packages?
So it's going to give us a source.
Unassociated files will probably not have a source.
It also has an uninstalled string, installed it from link file,
and we might have the manufacturer.
Like I said, you won't have every single thing one of these things for everyone,
we don't have one in this column.
But we did see manufacturing another key, device PNP,
this really is plug and play devices that we looked at.
We can see the key names, we just saw guids is if you remember under key name,
when we're looking with Register Explorer, but here it's parsing them for us.
We have a last write time stamp, we have a class, class quid.
We could search on class quid, we have a container ID,
we have a description, driver IDs, driver name, driver version date.
Then we have some more information and this is mainly pertaining to whether
it's USB, whether it's coming over PCI, where is this coming from?
We have more information about the device, because these are plug and play devices.
So, we have some vids, you can scroll through and look at the different results.
We have our manufacturer here, we have a model,
a model number, a name, we have PCI Express,
remote desktop, redirect bus, virtual drive enumerator.
So, where is it coming from?
What is the model?
We have a parent ID, who is the parent to this particular executable?
Parent IDs provider, we see Microsoft VM where lot of Microsoft programs, you will
see a lot of Microsoft programs, these are built in programs that aren't installed,
they're already installed, they come with Microsoft, we talked about that.
MS Pait, the calculator, there are some other things that come preinstalled,
note pad with Windows, you can see a service.
Now we look at an associated file entries.
It will have a program ID, it will have a key last write time and
we will have that show one hash value.
So, if these are indeed nefarious or malware type files, and
we have the show one is a known piece of malware, and we have a list
that we can run against this and we can do it right from the start,
as you saw with that minus B and minus W for blacklist and whitelist.
And ask if is a component of the OS, is OS component?
You're just going to get a true or false here.
You're going to see the full path.
You'll see the name, the extension, linked data,
product name, the size, the version, the product version.
And again, when they're talking about the version here, it's the version of windows
at the time of installation, this would be the product version.
We get some more information here, with our long path hash, our binary type.
What type is the binary?
The version of the bin file, bin product version if it has it,
and they will most likely be the same.
And then language is a code.
What language is it in?
As you can see AmCache gives us quite a bit of information,
it can be extremely helpful with our cases.
It can be extremely helpful if you're doing an incident response case.
But, it can be really helpful with all of our cases.
This shows us file and program execution.
If the files listed here, the file or application that exe was run,
that bin file was run, it was executed.
So, that also shows user knowledge, unless it's malware, or
it's something that's running and they don't know what's running.
So then we'd have to look in services to see what's running automatically.
If you've got USB devices like we said, you'd want to check all that information
with mounted devices in the system file, or mount points to in the ENT user hive.
You'd want to compare this with the information,
if you've got removable devices in here.
From the information, you got in shell bags, so
we want to connect all the pieces, and AmCache is a big piece of our puzzle.