Procedure examples

MuddyViper has the ability to establish persistence by creating a scheduled task named ManageOnDriveUpdater to launch itself during system startup.

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.

Spica has created a scheduled task named `CalendarChecker` to establish persistence.

Embargo has obtained persistence of the loader MDeployer by creating a scheduled task named “Perf_sys.”

MagicRAT can persist via scheduled tasks.

Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.

RedLine Stealer has achieved persistence via scheduled tasks.

OopsIE creates a scheduled task to run itself every three minutes.

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.

SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.

LitePower can create a scheduled task to enable persistence mechanisms.

Crutch has the ability to persist using scheduled tasks.

RTM tries to add a scheduled task to establish persistence.

BlackByte Ransomware creates a schedule task to execute remotely deployed ransomware payloads.

Sibot has been executed via a scheduled task.

ZxxZ has used scheduled tasks for persistence and execution.

Tarrask is able to create “hidden” scheduled tasks for persistence.

Bazar can create a scheduled task for persistence.

SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.

XLoader can create scheduled tasks for persistence.

HiddenFace has used scheduled tasks for execution and persistence.

CorKLOG has achieved persistence through the creation of a scheduled task named TableInputServices by using the command `schtasks /create /tn TabletlnputServices /tr /sc minute /mo 10 /f`.

Ryuk can remotely create a scheduled task to execute itself on a system.

HermeticWiper has the ability to use scheduled tasks for execution.

ccf32 can run on a daily basis using a scheduled task.

Kapeka persists via scheduled tasks.

LockBit 2.0 can be executed via scheduled task.

Zebrocy has a command to create a scheduled task for persistence.

EvilBunny has executed commands via scheduled tasks.

HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.

ServHelper contains modules that will use schtasks to carry out malicious operations.

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.

Milan can establish persistence on a targeted host with scheduled tasks.

Carbon creates several tasks for later execution to continue persistence on the victim’s machine.

DanBot can use a scheduled task for installation.

Solar can create scheduled tasks named Earth and Venus, which run every 30 and 40 seconds respectively, to support C2 and exfiltration.

Ramsay can schedule tasks via the Windows COM API to maintain persistence.

AshTag can set persistence using scheduled tasks.

Revenge RAT schedules tasks to run malicious scripts at different intervals.

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.

Mango can create a scheduled task to run every 32 seconds to communicate with C2 and execute received commands.

GrimAgent has the ability to set persistence using the Task Scheduler.

Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.

BabyShark has used scheduled tasks to maintain persistence.

BONDUPDATER persists using a scheduled task that executes every minute.

Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.

Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.

ComRAT has used a scheduled task to launch its PowerShell loader.

Disco can create a scheduled task to run every minute for persistence.