Scriptkd

Overview

Scriptkd (classified as Ransom:Win32/Scriptkd and Trojan-Ransom.Win32.Scriptkd) is a script-based and multi-stage crypto-ransomware family combining Windows Script Host (WSH/VBScript), PowerShell, and compiled PE binaries. Delivered via phishing attachments with .vbs or .wsf files, Scriptkd uses obfuscated script routines to bypass initial email gateways and static scanner heuristics. The script downloads or unpacks an AES-256 cryptographic locker onto the endpoint. Scriptkd traverses mounted drive letters and network shares, encrypting documents, databases, and image archives while appending custom extensions. It executes shell commands to wipe Volume Shadow Copies (vssadmin delete shadows /all /quiet) and creates persistent desktop ransom notifications.

Known aliases

Threat reports may refer to this family under multiple names:

• Ransom:Win32/Scriptkd
• Trojan-Ransom.Win32.Scriptkd
• Win32/Scriptkd
• Scriptkd Ransomware
• Ransom.Scriptkd

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.
• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_SCRIPTKD_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Scriptkd"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "scriptkd" ascii wide nocase
        $s2 = "ransom:win32/scriptkd" ascii wide nocase
        $s3 = "trojan-ransom.win32.scriptkd" ascii wide nocase
        $s4 = "win32/scriptkd" ascii wide nocase
        $s5 = "scriptkd ransomware" ascii wide nocase
        $s6 = "ransom.scriptkd" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Scriptkd (Ransomware) Execution & Triage
id: bc91e5f1-a825-53c7-83f2-ccfd2d9e2003
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Scriptkd malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/scriptkd
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1059_005
- attack.t1059_001
- attack.t1486
- attack.t1490
- attack.t1083
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_SCRIPTKD_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Scriptkd tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "scriptkd" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint; if `wscript.exe` successfully executed the Scriptkd payload, a secondary infection (like ransomware) is actively downloading or running.
2. Use EDR to immediately terminate any suspicious `wscript.exe`, `cscript.exe`, or `powershell.exe` processes executing out of user profile directories.
3. Review network proxies to identify the C2 domains contacted by the script and block them enterprise-wide.
4. Disable the Windows Script Host (WSH) globally via Group Policy if VBScript execution is not required for business operations.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is blocked just because the email gateway stripped the attachment; users may download the script via web links.
2. Avoid relying solely on static hash signatures for scripts, as attackers dynamically generate new obfuscation patterns for every email sent.

References & External Analysis

• Microsoft Defender Threat Encyclopedia - Ransom:Win32/Scriptkd
• Trend Micro Security Research - Ransom.Win32.Scriptkd Overview
• MITRE ATT&CK - Command and Scripting Interpreter: Visual Basic (T1059.005)
• Search "scriptkd" on VirusTotal (External Analysis)
• Search "scriptkd" on Any.Run (Sandbox Sandbox)
• Search "scriptkd" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Whiteclick
• Refinka
• Mdeclass
• Bodegun
• Mutant
• Gracewire
• Wiliky
• Adagent

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/scriptkd.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.