F028MEDIUMInconclusivevalidator: passed

NCPA (Nagios) monitoring agent executed from staging directory

path:C:\Windows\Temp\ncpa-2.0.4.exe

Analyst narrative

ncpa-2.0.4.exe (installer) executed from C:\Windows\Temp\ as registered in AppCompatCache. NCPA listener may have been installed for persistence or lateral movement.

Claims asserted

pathC:\Windows\Temp\ncpa-2.0.4.exeget_amcacheextract_mft_timeline

Proof chain · 3 facts

Every confirmed claim links by foreign key to the typed fact that validated it, and to the forensic tool that produced that fact. This is one finding_trace() query.

▷

appcompatcache execution factappcompatcache:sysvol/windows/temp/ncpa-2.0.4.exe

run_appcompatcacheparser

›

Raw tool output · a77e3b3a90a16efa4308115dfa29cd624f06d409

{"ControlSet": "1", "CacheEntryPosition": "58", "Path": "SYSVOL\\Windows\\Temp\\ncpa-2.0.4.exe", "LastModifiedTimeUTC": "2018-03-14 13:37:42", "Executed": "No", "Duplicate": "False", "SourceFile": "/tmp/sift-onboard-mnt/rd01-case/Windows/System32/config/SYSTEM"}

▷

appcompatcache execution factappcompatcache:sysvol/windows/temp/ncpa-2.0.4.exe

run_appcompatcacheparser

›

Raw tool output · 3c5bce536b378587bd55890099d37b67a3e92c87

{"ControlSet": "2", "CacheEntryPosition": "58", "Path": "SYSVOL\\Windows\\Temp\\ncpa-2.0.4.exe", "LastModifiedTimeUTC": "2018-03-14 13:37:42", "Executed": "No", "Duplicate": "True", "SourceFile": "/tmp/sift-onboard-mnt/rd01-case/Windows/System32/config/SYSTEM"}

•

file execution factsha1:60083cabeaad20fb97938602edf856ae8f2829bc

get_amcache

›

Raw tool output · 44ee16d1ce50440b887c7b582468e05c7ceffa21

{"path": "C:\\Windows\\Temp\\ncpa-2.0.4.exe", "sha1": "60083cabeaad20fb97938602edf856ae8f2829bc", "first_run": "", "publisher": null, "file_size": null}

Source tools

extract_mft_timelineget_amcache