1. Home
  2. Software
  3. Tarrask

Tarrask

Tarrask is malware that has been used by HAFNIUM since at least August 2021. Tarrask was designed to evade digital defenses and maintain persistence by generating concealed scheduled tasks.[1]

ID: S1011
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Sittikorn Sangrattanapitak
Version: 1.0
Created: 01 June 2022
Last Modified: 18 October 2022
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1036 .004 伪装: Masquerade Task or Service

Tarrask creates a scheduled task called "WinUpdate" to re-establish any dropped C2 connections.[1]
.005 伪装: Match Legitimate Name or Location

Tarrask has masqueraded as executable files such as winupdate.exe, date.exe, or win.exe.[1]

Enterprise T1112 修改注册表

Tarrask is able to delete the Security Descriptor (SD) registry subkey in order to "hide" scheduled tasks.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.[1]
Enterprise T1134 .001 访问令牌操控: Token Impersonation/Theft

Tarrask leverages token theft to obtain lsass.exe security permissions.[1]

Enterprise T1564 隐藏伪装

Tarrask is able to create "hidden" scheduled tasks by deleting the Security Descriptor (SD) registry value.[1]
Enterprise T1053 .005 预定任务/作业: Scheduled Task

Tarrask is able to create "hidden" scheduled tasks for persistence.[1]

Groups That Use This Software

ID Name References
G0125 HAFNIUM

[1]

References

  1. Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.