Trust but Verify: Amcache’s OriginalFilename Field Isn’t Always Accurate
Brief
During an engagement at $lastdayjob we found a possible bug in AmCache so I wanted to dig into it a bit deeper. Mostly this is a call for help, and an explanation of how to test!
TLDR Sometimes AmCache records an original filename is something when it either doesn’t exist in the original PE or it’s something else entirely. In our specific case we had a handful of binaries in a directory saying their original PE name was “Mimikatz. exe”, when they didn’t have the field at all.
Also, did you know AmCache will record the original filename of the PE if it’s there? Due to some recent improvements in AmcacheParser this is now surfaced!
How it started
After running Detectraptor across an organisation we observed instances of the OriginalFileName value within the Amcache registry keys not lining up with the expected Name of the executable.