Shimcache
Used to prove file existence and possibly what the TA saw in explorer.
File Location:
HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache
The cache stores various file metadata depending on the operating system, such as:
File Full Path
File Size
$Standard_Information (SI) Last Modified time
Shimcache Last Updated time
Process Execution Flag
Shimcache is a list of file metadata from executables that were recently executed, and thus examined for shimming, or executables examined for “the need to shim” but not executed.
Parsing Data
Considerations
HKLM\SYSTEM\Select - Determine what ControlSet is in use with the 'current' value.
1024 Per ControlSet
Renaming or moving the file will cause it to be re-shimmed.
Executing the PE in a command line will cause it to be shimmed (if it wasn't already shimmed).
Tracks execution on ALL drives (C:\ D:\ etc).
Can no longer be used as evidence of execution on Windows 10/11.
Only flushed to the registry on reboot or shutdown.
Showing the file partially in explorer will still result in it being added to Shimcache.
Legitimate Execution
Each time an application with unique metadata is executed, a corresponding Shimcache entry will be created. In other words, new entries are created when an existing file’s metadata has changed and is re-executed.
Psexec Considerations
Psexec modifies the $DATA attribute of the file every time it runs. Finding multiple Shimcache entries with different modified timestamps are an indication that psexec executed at those specified times.
| Last Modified | Path | File Size |
|---|---|---|
02/01/03 07:55:11 | C:\WINNT\system32\Malware.exe | 185552 |
10/08/13 20:02:05 | C:\WINNT\PSEXESVC.EXE | 53248 |
03/18/10 18:16:49 | C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ngen.exe | 150856 |
… | … | … |
12/10/10 22:39:02 | d:\MSSQL.1\MSSQL\Binn\DatabaseMail90.exe | 16224 |
07/25/08 16:17:35 | C:\WINDOWS\Microsoft.Net\Framework\v2.0.50727\ngen.exe | 100856 |
09/15/03 19:41:35 | C:\WINNT\system32\Malware.exe | 185552 |
10/11/12 11:22:23 | C:\WINNT\PSEXESVC.EXE | 53248 |
Network Shimcache
Can be used as evidence of the file existing on a network share. This indicates that the user either navigated to the share using explorer.exe or that the malware executed on the share resulting in the p.exe executable being shimmed. Best paired with shellbags to determine which is true.
Anti Forensics
Can compare timestamp in shimcache to original binary to compare timestamps. This can be used as evidence of TimeStomping.
Renaming a file will re-shim the binary, but the modification timestamp will not change. Because renaming to does not change contents of file.
File deletion will NOT delete Shimcache entries.
Last updated
