Sunturai
Back to results
MediumSplunk security contentMichael Haag +1

Windows Snake Malware Registry Modification wav OpenWithProgIds

The following analytic identifies modifications to the registry path .wav\\OpenWithProgIds, associated with the Snake Malware campaign. It leverages data from the Endpoint.Registry datamodel to detect changes in this…

Description

The following analytic identifies modifications to the registry path .wav\\OpenWithProgIds, associated with the Snake Malware campaign. It leverages data from the Endpoint.Registry datamodel to detect changes in this specific registry location. This activity is significant because Snake's WerFault.exe uses this registry path to decrypt an encrypted blob containing critical components like the AES key, IV, and paths for its kernel driver and loader. If confirmed malicious, this could allow the attacker to load and execute Snake's kernel driver, leading to potential system compromise and persistent access.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_eventid_13

Known benign triggers

  • False positives may be present and will require tuning based on program Ids in large organizations.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice