osk.exe

  • File Path: C:\windows\system32\osk.exe
  • Description: Accessibility On-Screen Keyboard

Screenshot

osk.exe

Hashes

Type Hash
MD5 17BD0C6AA822D5957EF63E3884CF5BC2
SHA1 7D94A06925A167FB061A0623F65353052D497BE3
SHA256 C7E22B9BF45AE6578810914AD912CAB77D3F3C5EE0B716E48028C124E1233F73
SHA384 EE16EB95CF2F3A3FCD6531827E951781AF4B6BF6F7D164D50C4B55360F2BA504781F2069AEA403451B13182D55927AB4
SHA512 5199173AA5C5D72B5438CD3DC57295C963C1B4DC98C362C034341B1098861186C5B6880F15CDA49EF244294CACCE88537FBC17A00D50B2E7B3DF47C6E2500925
SSDEEP 6144:I0ZXOZ2Sxhqn66VhQMUbC+J6yihdIbmbVobH3AdKy9HGeofJgDEvr6slnCUGw/xl:6ZBxhqn66VuL1kyY3jmNwzaoo

Signature

  • Status: The file C:\windows\system32\osk.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: osk.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\osk.exe 50
C:\Windows\system32\osk.exe 50
C:\WINDOWS\system32\osk.exe 52
C:\Windows\system32\osk.exe 50
C:\Windows\system32\osk.exe 54
C:\windows\SysWOW64\osk.exe 50
C:\Windows\SysWOW64\osk.exe 60

Possible Misuse

The following table contains possible examples of osk.exe being misused. While osk.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_uac_bypass_wmp.yml TargetFilename: 'C:\Program Files\Windows Media Player\osk.exe' DRL 1.0
sigma proc_creation_win_install_reg_debugger_backdoor.yml - 'osk.exe' DRL 1.0
sigma proc_creation_win_stickykey_like_backdoor.yml - 'osk.exe' DRL 1.0
sigma proc_creation_win_uac_bypass_wmp.yml Image: 'C:\Program Files\Windows Media Player\osk.exe' DRL 1.0
sigma registry_event_stickykey_like_backdoor.yml - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger' DRL 1.0
sigma registry_event_uac_bypass_wmp.yml TargetObject\|endswith: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe' DRL 1.0
LOLBAS Wmic.yml - Command: wmic.exe process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"  
LOLBAS Wmic.yml Description: Add cmd.exe as a debugger for the osk.exe process. Each time osk.exe is run, cmd.exe will be run as well.  
atomic-red-team T1546.008.md * On-Screen Keyboard: C:\Windows\System32\osk.exe MIT License. © 2018 Red Canary
atomic-red-team T1546.008.md Upon successful execution, powershell will modify the registry and swap osk.exe with cmd.exe. MIT License. © 2018 Red Canary
atomic-red-team T1546.008.md | parent_list | Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: “osk.exe” | String | osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe| MIT License. © 2018 Red Canary
signature-base thor_inverse_matches.yar description = “Abnormal osk.exe (On Screen Keyboard) - typical strings not found in file” CC BY-NC 4.0
signature-base thor_inverse_matches.yar filename == “osk.exe” CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.