LoFP / false positives may be present and will require tuning based on program ids in large organizations.

Techniques

• T1112

Sample rules

Windows Snake Malware Registry Modification wav OpenWithProgIds

• source: splunk
• technicques:
  • T1112

Description

The follow analytic identifies the registry being modified at .wav\OpenWithProgIds, which is related to the Snake Malware campaign. Upon execution, Snake’s WerFault.exe will attempt to decrypt an encrypted blob within the Windows registry that is typically found at HKLM:\SOFTWARE\Classes.wav\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake’s kernel driver and kernel driver loader.

Detection logic

| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*"  by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `drop_dm_object_name(Registry)` 
| `windows_snake_malware_registry_modification_wav_openwithprogids_filter`