Tarrask

Malware & Tools · Tarrask

· MalwareS1011 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Tarrask is malware that has been used by HAFNIUM since at least August 2021. Tarrask was designed to evade digital defenses and maintain persistence by generating concealed scheduled tasks.(Citation: Tarrask scheduled task)

Tactic Coverage

stealth (4)execution (2)persistence (2)privilege escalation (2)defense impairment (1)

Used By (1 groups)

G0125HAFNIUMOperation Exchange Marauder, Silk Typhoon

Techniques (7)

T1036.004Masquerade Task or Service

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1053.005Scheduled Task

executionpersistence

T1059.003Windows Command Shell

execution

T1112Modify Registry

defense impairmentpersistence

T1134.001Token Impersonation/Theft

stealth

References

https://attack.mitre.org/software/S1011 https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/