Do You Even Search Dude: Windows.db & PCA AppHelp Triage
“A CEO's corporate workstation was compromised. The attacker attempted to evade disk forensics by wiping standard execution logs. Analyze the Windows.db Extensible Storage Engine (ESE) database and KAPE triage collection to reconstruct the executed malware payload.”
ASCWG{...}A CEO's workstation was compromised. We were provided with a KAPE triage collection and tasked with identifying exactly what the attacker ran and where they hid the evidence. This challenge was an exercise in avoiding rabbit holes and looking in the last place anyone expects: the Windows Search database itself.
Stage 1: The Execution Anchor
Forensic Analysis: Execution & Artifact Staging
Windows Program Compatibility Assistant (PCA) keeps execution evidence in the registry and diagnostic stores. While OfficeUpdater.exe execution was confirmed via PCA entries, the binary itself was a decoy dropper. The encrypted payload buffer was staged directly inside the Windows Search database (Windows.db), requiring ESE database parsing to carve the raw ciphertext blob.
Q: Where did the attacker hide the actual payload data?
A: The Windows Search Database (Windows.db)
Initial investigation revealed an execution record for C:\Users\user\AppData\Local\Temp\OfficeUpdater.exe via the Program Compatibility Assistant (PCA)A Windows service that monitors programs for compatibility issues. Its logs often retain evidence of malware execution long after the malware is deleted.. Simply searching for the executable name was a rabbit hole designed to distract investigators. The actual flag was hidden within Windows Search database residue.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000 41 00 00 00 01 00 00 00 10 00 00 00 00 00 00 00 A...............
00000010 a3 f1 c8 9b 72 1e 5a 44 8f 3c 11 22 4a 99 bb 01 £ñÈ.r.ZD.<."J.».
00000020 ... [48 Bytes High-Entropy Ciphertext] ... ................
# Decryption using PCA AppHelp SolutionID (Key):
> python decrypt_blob.py --key "{A92B31-...}" --data payload.bin
SUCCESS: ASCWG{c0mp4t_s0luti0n_h1d_th3_k3y_w1thin}from Crypto.Cipher import AES
import hashlib
# 1. SolutionID extracted from PCA AppHelp database
solution_id = "{A92B31C4-7D4F-4A92-B582-82E9104A7F11}"
key = hashlib.sha256(solution_id.encode('utf-16le')).digest()[:16]
# 2. 48-byte ciphertext blob extracted from Windows.db System.Search.AutoSummary
ciphertext = bytes.fromhex("a3f1c89b721e5a448f3c11224a99bb012f5a89b0...")
cipher = AES.new(key, AES.MODE_CBC, iv=b"\x00"*16)
decrypted = cipher.decrypt(ciphertext)
print("[+] Decrypted Flag:", decrypted.decode('utf-8', errors='ignore'))python -c "from Crypto.Cipher import AES; import hashlib; k=hashlib.sha256('{A92B31C4-7D4F-4A92-B582-82E9104A7F11}'.encode('utf-16le')).digest()[:16]; print(AES.new(k,AES.MODE_CBC,b'\x00'*16).decrypt(bytes.fromhex('...')).decode('latin1'))"[ SHOW METHODOLOGY: Windows.db & PCA AppHelp Decryption ]▼
- Navigated to
ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db. - Correlated the execution of
OfficeUpdater.exewith suspicious binary data found in theSystem.Search.AutoSummaryentries. - Extracted a 64-byte blob: 16 bytes of structured data and 48 bytes of high-entropy ciphertext.
- Recovered the PCA
AppHelpmetadata from the registry/event logs, which provided aSolutionID. - Used the
SolutionIDas the cryptographic key to decrypt the 48-byte blob, revealing the final string.
Decrypted Final Flag:
ASCWG{c0mp4t_s0luti0n_h1d_th3_k3y_w1thin}
The Complete Investigation Path & Mental Roadmap
Here is the step-by-step roadmap from initial KAPE triage to decrypting the hidden ESE database blob:
Discovered PCA execution entry for OfficeUpdater.exe. Confirmed the executable was an empty decoy placed to distract analysts.
Loaded Windows.db into ESEDatabaseView. Scanned System.Search.AutoSummary table and located high-entropy 48-byte binary blob residue.
Cross-referenced Windows Event Logs and found the PCA Compatibility database SolutionID GUID.
Derived the AES key via UTF-16LE SHA-256 and decrypted the 48-byte blob using Python.
Extracted the final flag: ASCWG{c0mp4t_s0luti0n_h1d_th3_k3y_w1thin}.