Snake Malware Registry Modification via .wav\OpenWithProgIds

Snake malware, a sophisticated espionage tool, utilizes specific registry modifications as a mechanism to decrypt critical configuration data. The malware targets the registry path ".wav\OpenWithProgIds" to store or trigger the retrieval of encrypted blobs. When accessed by the legitimate Windows process 'WerFault.exe', this registry data is decrypted to reveal essential components, including AES keys, initialization vectors (IVs), and the file paths required to load the malware's custom kernel driver and loader. This technique allows the malware to bypass traditional signature-based detection by keeping its core configuration encrypted and off-disk until runtime. For defenders, monitoring modifications to this specific registry key is a high-fidelity signal of Snake malware activity, as legitimate applications rarely utilize this path for configuration storage.

Attack Chain

1. Initial compromise occurs, allowing the execution of the Snake loader.
2. The loader prepares the malicious payload and necessary configuration data.
3. The malware writes an encrypted blob or modifies subkeys within ".wav\OpenWithProgIds" in the Windows Registry.
4. 'WerFault.exe' is invoked or coerced into processing the modified registry values.
5. The malware uses the stored registry data to derive the AES key and IV.
6. Decryption of the configuration blob exposes paths to the final-stage kernel driver.
7. The kernel driver is loaded into the operating system memory, granting the attacker persistent, high-privilege access.
8. Final objective of espionage or exfiltration is achieved through the active kernel-level presence.

Impact

Successful exploitation by Snake malware results in full system compromise via kernel-level access. This allows for stealthy, long-term persistence that is extremely difficult to detect or remove from the OS. Historically, this malware has targeted sensitive government and critical infrastructure sectors. Compromise leads to significant risks of data exfiltration and complete loss of control over the affected host.

Recommendation

• Deploy the Sigma rule below to detect unauthorized modifications to the .wav registry hive.
• Enable Sysmon Event ID 13 (Registry Event) logging across all endpoints to capture the necessary 'TargetObject' and 'Details' information.
• Investigate any processes modifying the .wav\OpenWithProgIds key that are not part of a documented, legitimate software update or deployment.
• Utilize the provided Atomic Red Team test (Guid: 8318ad20-0488-4a64-98f4-72525a012f6b) to validate detection coverage in your environment.