Shimcache
Used to prove file existence and possibly what the TA saw in explorer.
Last updated
Used to prove file existence and possibly what the TA saw in explorer.
Last updated
File Location:
HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache\AppCompatCache
The cache stores various file metadata depending on the operating system, such as:
File Full Path
File Size
$Standard_Information (SI) Last Modified time
Shimcache Last Updated time
Process Execution Flag
Shimcache is a list of file metadata from executables that were recently executed, and thus examined for shimming, or executables examined for “the need to shim” but not executed.
HKLM\SYSTEM\Select - Determine what ControlSet is in use with the 'current' value.
1024 Per ControlSet
Renaming or moving the file will cause it to be re-shimmed.
Executing the PE in a command line will cause it to be shimmed (if it wasn't already shimmed).
Tracks execution on ALL drives (C:\ D:\ etc).
Can no longer be used as evidence of execution on Windows 10/11.
Only flushed to the registry on reboot or shutdown.
Showing the file partially in explorer will still result in it being added to Shimcache.
Each time an application with unique metadata is executed, a corresponding Shimcache entry will be created. In other words, new entries are created when an existing file’s metadata has changed and is re-executed.
Psexec modifies the $DATA attribute of the file every time it runs. Finding multiple Shimcache entries with different modified timestamps are an indication that psexec executed at those specified times.
02/01/03 07:55:11
C:\WINNT\system32\Malware.exe
185552
10/08/13 20:02:05
C:\WINNT\PSEXESVC.EXE
53248
03/18/10 18:16:49
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\ngen.exe
150856
…
…
…
12/10/10 22:39:02
d:\MSSQL.1\MSSQL\Binn\DatabaseMail90.exe
16224
07/25/08 16:17:35
C:\WINDOWS\Microsoft.Net\Framework\v2.0.50727\ngen.exe
100856
09/15/03 19:41:35
C:\WINNT\system32\Malware.exe
185552
10/11/12 11:22:23
C:\WINNT\PSEXESVC.EXE
53248
Can be used as evidence of the file existing on a network share. This indicates that the user either navigated to the share using explorer.exe or that the malware executed on the share resulting in the p.exe executable being shimmed. Best paired with shellbags to determine which is true.
Can compare timestamp in shimcache to original binary to compare timestamps. This can be used as evidence of TimeStomping.
Renaming a file will re-shim the binary, but the modification timestamp will not change. Because renaming to does not change contents of file.
File deletion will NOT delete Shimcache entries.