{"id":112008,"date":"2022-04-12T09:00:00","date_gmt":"2022-04-12T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=112008"},"modified":"2025-06-20T02:41:15","modified_gmt":"2025-06-20T09:41:15","slug":"tarrask-malware-uses-scheduled-tasks-for-defense-evasion","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/04\/12\/tarrask-malware-uses-scheduled-tasks-for-defense-evasion\/","title":{"rendered":"Tarrask malware uses scheduled tasks for defense evasion"},"content":{"rendered":"\n

April 2023 update<\/strong> \u2013 Microsoft Threat Intelligence has shifted to a new threat actor naming taxonomy aligned around the theme of weather. HAFNIUM <\/strong>is now tracked as Silk Typhoon<\/strong>.<\/p>\n\n\n\n

To learn about how the new taxonomy represents the origin, unique traits, and impact of threat actors, and to get a complete mapping of threat actor names, read this blog: Microsoft shifts to a new threat actor naming taxonomy<\/strong><\/a>.<\/p>\n\n\n\n

\n\n\n\n

As Microsoft continues to track the high-priority state-sponsored threat actor HAFNIUM<\/a>, new activity has been uncovered that leverages unpatched zero-day vulnerabilities as initial vectors. The Microsoft Detection and Response Team (DART) in collaboration with the Microsoft Threat Intelligence Center (MSTIC) identified a multi-stage attack targeting the Zoho Manage Engine Rest API authentication bypass vulnerability to initially implant a Godzilla web shell with similar properties detailed by the Unit42 team in a previous blog<\/a>. <\/p>\n\n\n\n

Microsoft observed HAFNIUM from August 2021 to February 2022, target those in the telecommunication, internet service provider and data services sector, expanding on targeted sectors observed from their earlier operations conducted in Spring 2021<\/a>.<\/p>\n\n\n\n

Further investigation reveals forensic artifacts of the usage of Impacket tooling for lateral movement and execution and the discovery of a defense evasion malware called Tarrask that creates \u201chidden\u201d scheduled tasks, and subsequent actions to remove the task attributes, to conceal the scheduled tasks from traditional means of identification.<\/p>\n\n\n\n

The blog outlines the simplicity of the malware technique Tarrask uses, while highlighting that scheduled task abuse is a very common method of persistence and defense evasion\u2014and an enticing one, at that. In this post, we will demonstrate how threat actors create scheduled tasks, how they cover their tracks, how the malware’s evasion techniques are used to maintain and ensure persistence on systems, and how to protect against this tactic.<\/p>\n\n\n\n

Right on schedule: Maintaining persistence via scheduled tasks<\/h2>\n\n\n\n

Windows Task Scheduler is a service that allows users to perform automated tasks (scheduled tasks) on a chosen computer for legitimate administrative purposes (e.g., scheduled updates for browsers and other applications).<\/p>\n\n\n\n

Throughout the course of our research, we\u2019ve found that threat actors commonly make use of this service to maintain persistence within a Windows environment.<\/p>\n\n\n\n

We\u2019ve noted that the Tarrask malware generates several artifacts upon the creation of a scheduled task, whether using the Task Scheduler GUI or the schtasks<\/a> command line utility. Profiling the use of either of these tools can aid investigators in tracking this persistence mechanism.<\/p>\n\n\n\n

The following registry keys are created upon creation of a new task:<\/p>\n\n\n\n