Kimsuky JSE loader WScript.exe registry enumeration of exefile shell associations

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.