When it comes to digital forensics, AmCache plays a vital role in identifying malicious activities in Windows systems. This artifact allows the identification of the execution of both benign and malicious software on a machine.
It is managed by the operating system, and at the time of writing this article, there is no known way to modify or remove AmCache data. Thus, in an incident response scenario, it could be the key to identifying lost artifacts (e.g., ransomware that auto-deletes itself), allowing analysts to search for patterns left by the attacker, such as file names and paths.
Read more…
Source: Kaspersky
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Royal Mail resumes overseas mail at post offices after cyber-attack
February 21, 2023
International mail services have finally been reinstated at UK post offices, more than a month after Royal Mail was hit by a cyber attack. The breach on 10 January caused a backlog that led to long delays for consumers and businesses. Read more… Source: BBC News
- UK government “left council to deal with ransomware attack” that cost £11m
February 9, 2023
The government left Redcar and Cleveland Borough Council to fight a massive ransomware attack alone for a week, with minimal support or correspondence, the council’s leader has said. Mary Lanigan told MPs yesterday that while police and cybercrime officers were on site within two days, help from Westminster was lacking. Recovering from the incident cost ...
- Ontario: Children’s Hospital Expects Weekslong Ransomware Recovery
December 28, 2022
Nearly a week after a ransomware attack forced a network shutdown at Toronto’s Hospital for Sick Children, patients are still experiencing delays in treatment and diagnostic procedures. The hospital says it has restored some systems, phones and websites, but the recovery process could take weeks. Hackers targeted the hospital’s network on Dec. 19, forcing it to ...
- Guardian hit by serious IT incident believed to be ransomware attack
December 21, 2022
The Guardian has been hit by a serious IT incident, which is believed to be a ransomware attack. The incident began late on Tuesday night and has affected parts of the company’s technology infrastructure, with staff told to work from home. There has also been some disruption to behind-the-scenes services. Read more… Source: The Guardian
- Antwerp cyber attacks: Mayor says city will not negotiate or pay
December 18, 2022
For over a week, the services of the city of Antwerp have been targeted by a nefarious hacking collective called Play, which alleges to have stolen sensitive data that it will publish if the city fails to pay a ransom by Monday. After a week of administrative services – including libraries, museum booking sites, and council ...
- REvil-hit Medibank to pull plug on IT, shore up defenses
December 8, 2022
Australian health insurance company Medibank will take all of its IT systems offline and close its branches over the weekend as part of its ongoing efforts to improve security and recover from a massive data security breach in October. The planned outage, dubbed Operation Safeguard, begins at 2030 Sydney time on Friday, December 9. The insurer ...