When it comes to digital forensics, AmCache plays a vital role in identifying malicious activities in Windows systems. This artifact allows the identification of the execution of both benign and malicious software on a machine.
It is managed by the operating system, and at the time of writing this article, there is no known way to modify or remove AmCache data. Thus, in an incident response scenario, it could be the key to identifying lost artifacts (e.g., ransomware that auto-deletes itself), allowing analysts to search for patterns left by the attacker, such as file names and paths.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Police Service Northern Ireland had 260 data breaches in two years, with only a fraction reported or disclosed
June 12, 2024
Figures released under a Freedom of Information request have shown the PSNI had 260 data breaches over two years — but only a fraction of them were reported to external authorities, and even fewer were publicly disclosed. In one case, a data breach was not reported for almost eight years. In 2022, there were 154 breaches, ...
- Canada does not have the tools to fight cyber crime, says watchdog
June 5, 2024
Canada’s federal government does not have the capacity and tools to effectively fight cyber crime in part because of excessive bureaucracy and staff shortages, the country’s top watchdog said on Tuesday. In an official report, Auditor General Karen Hogan said she found breakdowns in response, coordination, tracking, and information sharing between and across the organizations responsible ...
- ‘People’s lives are at risk’: Ascension ransomware attack going on nearly three weeks
May 29, 2024
A ransomware attack on a major US hospital network that began three weeks ago is endangering patients’ health as nurses are forced to manually enter prescription information and work without electronic health records, nurses at two hospitals affected by the cyberattack told CNN. “It’s putting patients’ lives in danger,” said a nurse who works at Ascension ...
- LockBit demands $25 million from Canadian pharmacy chain London Drugs after ransomware attack
May 23, 2024
The recent cyber-incident against Canadian pharmacy chain London Drugs was indeed a full-blown ransomware attack, with sensitive data being stolen, and a major ransom being demanded, the company has confirmed. In a statement given to The Register, the company said it had been hit, but stressed it also had no intention of paying the ransom demand. ...
- New Caledonia foils a cyberattack “of unprecedented strength”
May 22, 2024
Millions of emails, from “different countries”, were sent to New Caledonia on Tuesday, May 21, after the announcement of Emmanuel Macron’s visit to the territory. “An access provider suffered an attack to saturate the New Caledonian network. The teams managed to control this attack. Millions of emails were sent simultaneously to an email address, which was ...
- Western Sydney University staff, students caught in cyber attack
May 21, 2024
About 7500 staff and students have been caught up in a massive cyber attack at Western Sydney University. Police are investigating the breach, which the university says dates as far back as May 2023, when an unauthorised party got into the Microsoft Office system and accessed email accounts and SharePoint files. WSU says they have not ...