# Shimcache

**File Location:**

* HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache

The cache stores various file metadata depending on the operating system, such as:

* File Full Path
* File Size
* **$Standard\_Information** (SI) Last Modified time
* Shimcache Last Updated time
* Process Execution Flag

Shimcache is a list of file metadata from executables that were recently executed, and thus examined for shimming, or executables examined for “the need to shim” but not executed.

{% embed url="<https://forensafe.com/blogs/shimcache.html>" %}

{% embed url="<https://andreafortuna.org/2017/10/16/amcache-and-shimcache-in-forensic-analysis/>" %}

{% embed url="<https://countuponsecurity.com/2016/05/18/digital-forensics-shimcache-artifacts/>" %}

{% embed url="<https://techcommunity.microsoft.com/t5/ask-the-performance-team/demystifying-shims-or-using-the-app-compat-toolkit-to-make-your/ba-p/374947>" %}

{% embed url="<https://bromiley.medium.com/windows-wednesday-shim-cache-1997ba8b13e7>" %}

### Parsing Data

{% code overflow="wrap" %}

```
AppCompatCacheParser -f F:\Tools\investigate\logs\SYSTEM --csv F:\Tools\investigate\logs --csvf reboot.csv 
```

{% endcode %}

### Considerations

* HKLM\SYSTEM\Select - Determine what ControlSet is in use with the 'current' value.&#x20;

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F1eTO3TpSHiZOVm8oi4W4%2Fimage.png?alt=media&#x26;token=b6b396ae-6107-4e47-adf7-3d7d6fff31f6" alt=""><figcaption><p>ControlSet001 is in use.</p></figcaption></figure>

* 1024 Per ControlSet
* Renaming or moving the file will cause it to be re-shimmed.
* Executing the PE in a command line will cause it to be shimmed (if it wasn't already shimmed).
* Tracks execution on ALL drives (C:\ D:\ etc).
* Can no longer be used as evidence of execution on Windows 10/11.
* Only flushed to the registry on reboot or shutdown.
* Showing the file partially in explorer will still result in it being added to Shimcache.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FBaqkNq3u31PIJmeJVYDw%2Fimage.png?alt=media&#x26;token=8c6b8999-e4fd-4e2d-9a26-a6b676140c51" alt=""><figcaption><p>Partial view of 27.exe</p></figcaption></figure>

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FUVsGSzEnM25vQUo0lbDc%2Fimage.png?alt=media&#x26;token=4d15d02e-5eac-49d7-80e0-5db985e5c084" alt=""><figcaption><p>27.exe is at the top of the Shimcache entry position.</p></figcaption></figure>

### Legitimate Execution

Each time an application with unique metadata is executed, a corresponding Shimcache entry will be created. In other words, new entries are created when an existing file’s metadata has changed and is re-executed.

### Psexec Considerations

Psexec modifies the $DATA attribute of the file every time it runs. Finding multiple Shimcache entries with different modified timestamps are an indication that psexec executed at those specified times.

| Last Modified         | Path                                                   | File Size |
| --------------------- | ------------------------------------------------------ | --------- |
| **02/01/03 07:55:11** | **C:\WINNT\system32\Malware.exe**                      | 185552    |
| **10/08/13 20:02:05** | **C:\WINNT\PSEXESVC.EXE**                              | 53248     |
| 03/18/10 18:16:49     | C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ngen.exe | 150856    |
| …                     | …                                                      | …         |
| 12/10/10 22:39:02     | d:\MSSQL.1\MSSQL\Binn\DatabaseMail90.exe               | 16224     |
| 07/25/08 16:17:35     | C:\WINDOWS\Microsoft.Net\Framework\v2.0.50727\ngen.exe | 100856    |
| **09/15/03 19:41:35** | **C:\WINNT\system32\Malware.exe**                      | 185552    |
| **10/11/12 11:22:23** | **C:\WINNT\PSEXESVC.EXE**                              | 53248     |

{% embed url="<https://www.mandiant.com/resources/blog/caching-out-the-val>" %}

### Network Shimcache

Can be used as evidence of the file existing on a network share. This indicates that the user either navigated to the share using explorer.exe or that the malware executed on the share resulting in the p.exe executable being shimmed. Best paired with shellbags to determine which is true.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FrcGeUxYEhIy89kFtWuvw%2Fimage.png?alt=media&#x26;token=3d5e0997-c8d2-4f31-951a-93af71d75753" alt=""><figcaption></figcaption></figure>

### Anti Forensics

* Can compare timestamp in shimcache to original binary to compare timestamps. This can be used as evidence of TimeStomping.
* Renaming a file will re-shim the binary, but the modification timestamp will not change. Because renaming to does not change contents of file.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FUO8fQOngGs4tZGvSW21u%2Fimage.png?alt=media&#x26;token=29d42cb5-7812-4aae-941f-4ae3ff4100ce" alt=""><figcaption><p>Rename Evidence (close modification timestamp)</p></figcaption></figure>

* File deletion will NOT delete Shimcache entries.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F1ijv9sD4UYRZ9XzCbimm%2Fimage.png?alt=media&#x26;token=22bc6635-1dfd-4ef4-a5e0-b445d3f2f1d5" alt=""><figcaption><p>Entries after file deletion.</p></figcaption></figure>