Techniques
Sample rules
Windows Snake Malware Registry Modification wav OpenWithProgIds
- source: splunk
- technicques:
- T1112
Description
The following analytic identifies modifications to the registry path .wav\OpenWithProgIds, associated with the Snake Malware campaign. It leverages data from the Endpoint.Registry datamodel to detect changes in this specific registry location. This activity is significant because Snake’s WerFault.exe uses this registry path to decrypt an encrypted blob containing critical components like the AES key, IV, and paths for its kernel driver and loader. If confirmed malicious, this could allow the attacker to load and execute Snake’s kernel driver, leading to potential system compromise and persistent access.
Detection logic
| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name
| `security_content_ctime(lastTime)`
| `security_content_ctime(firstTime)`
| `drop_dm_object_name(Registry)`
| `windows_snake_malware_registry_modification_wav_openwithprogids_filter`