'Shimcache'에 해당되는 글 1건

  1. 2020.12.31 Windows 10 레지스트리(Registry) 분석
Digital Forensics/Windows2020. 12. 31. 20:00
반응형

레지스트리 분석도구

  • RegRipper (by keydet89) : 텍스트 형태로 출력 (국내 도구)

github.com/keydet89/RegRipper3.0

 

keydet89/RegRipper3.0

RegRipper3.0. Contribute to keydet89/RegRipper3.0 development by creating an account on GitHub.

github.com

 

  • Registry Explorer (by Eric Zimmerman) : 세계에서 가장 많이 사용함. GUI

ericzimmerman.github.io/#!index.md

 

Eric Zimmerman's tools

 

ericzimmerman.github.io

 

  • REGA (업데이트X)

forensic.korea.ac.kr/DFWIKI/index.php/REGA(Registry_Analyzer)

 

REGA(Registry Analyzer) - Digital Forensic Wikipedia

REGA는 4&6Tech에서 개발한 레지스트리 분석 도구로 유료이다. 마지막 업데이트는 2013년 10월 22일이며, 최신 버전은 1.5.0.4버전이다. REGA는 GUI기반이며 Windows운영체제에서 사용 가능하다. REGA는 [표 1]

forensic.korea.ac.kr

 

  • X-ways : 기본적인 분석 가능. 특히, 사용자 정의 포맷으로 레포트를 내보낼 있다는 점이 장점

 

 

Windows 10에서 새로 봐야하는 Registry

  • Windows 10부터는 Registry Transaction 수행함 (.log 파일도 수집해서 분석해야함!)

c.f) https://www.fireeye.com/blog/threat-research/2019/01/digging-up-the-past-windows-registry-forensics-revisited.html

 

Digging Up the Past: Windows Registry Forensics Revisited

Learn about using Windows registry data when performing forensic analysis of computer networks.

www.fireeye.com

 

  • bam (=background application manager)

c.f) BAM/DAM

Description Windows Background Activity Moderator (BAM) Location Win10: SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID} SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID} Investigative Notes Provides full path of the executable file that was run on the system and last execution date/time

 

  • Shimcache

SYSTEM\ControlSet001\Control\Session Manager\AppCompatCache

(윈도우10 호환성 문제로 대체 API 실행한 흔적 -> Malware 흔적을 확인할 있음)

Description • Windows Application Compatibility Database is used by Windows to identify possible application compatibility challenges with executables. • Tracks the executables file name, file size, last modified time, and in Windows XP the last update time

Location XP: SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatibility Win7/8/10: SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

Interpretation: Any executable run on the Windows system could be found in this key. You can use this key to identify systems that specific malware was executed on. In addition, based on the interpretation of the time-based data you might be able to determine the last time of execution or activity on the system. • Windows XP contains at most 96 entries - LastUpdateTime is updated when the files are executed • Windows 7 contains at most 1,024 entries - LastUpdateTime does not exist on Win7 systems

 

c.f) Windows 10 Timeline

Description Win10 records recently used applications and files in a “timeline” accessible via the “WIN+TAB” key. The data is recorded in a SQLite database.

Location C:\Users\\AppData\Local\ConnectedDevices Platform\L.\ActivitiesCache.db

Interpretation • Application execution • Focus count per application

 

  • RecentApps

Description GUI Program execution launched on the Win10 system is tracked in the RecentApps key

Location Win10: NTUSER.DAT\Software\Microsoft\Windows\Current Version\Search\RecentApps

Interpretation Each GUID key points to a recent application. AppID = Name of Application LastAccessTime = Last execution time in UTC LaunchCount = Number of times executed

반응형
Posted by CCIBOMB