Procedure examples

The different components of Machete are executed by Windows Task Scheduler.

PUBLOAD has created scheduled tasks to maintain persistence with the command `schtasks.exe /F /Create /TN Microsoft_Licensing /sc minute /MO 1 /TR C:\\Users\\Public\\Libraries\...`

SystemBC has executed a copy of itself as a scheduled task with the `start` command. The copy of SystemBC has random file and directory names within the ProgramData directory.

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.

CLAIMLOADER has created scheduled tasks that execute the loader every five(5) minutes using `schtasks /F /Create /TN \"<fake_software_name>\" /SC minute /MO 5 /TR
\"C:\\ProgramData\\<path_to_exe> <hardcoded_argument>\`.

Apostle achieves persistence by creating a scheduled task, such as MicrosoftCrashHandlerUAC.

Okrum's installer can attempt to achieve persistence by creating a scheduled task.

SameCoin has the ability to set a scheduled task for execution.

RemoteCMD can execute commands remotely by creating a new schedule task on the remote system

IcedID has created a scheduled task to establish persistence.

Nightdoor uses scheduled tasks for persistence to load the final malware payload into memory.

CHIMNEYSWEEP can use the Windows `SilentCleanup` scheduled task to enable payload execution.

Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.

zwShell has used SchTasks for execution.

NotPetya creates a task to reboot the system one hour after infection.

ISMInjector creates scheduled tasks to establish persistence.

GoldMax has used scheduled tasks to maintain persistence.

Anchor can create a scheduled task for persistence.

Pteranodon schedules tasks to invoke its components in order to establish persistence.

DarkWatchman has created a scheduled task for persistence.

Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.

PlugX has created a scheduled task to execute additional malicious software, as well as maintain persistence.

MultiLayer Wiper creates a malicious scheduled task that launches a batch file to remove Windows Event Logs.

Remsec schedules the execution one of its modules by creating a new scheduler task.

PureCrypter can maintain persistence with scheduled tasks.

SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.

Gazer can establish persistence by creating a scheduled task.

Latrodectus can create scheduled tasks for persistence.

Saint Bot has created a scheduled task named "Maintenance" to establish persistence.

MuddyViper has the ability to establish persistence by creating a scheduled task named ManageOnDriveUpdater to launch itself during system startup.

QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.

Spica has created a scheduled task named `CalendarChecker` to establish persistence.

Embargo has obtained persistence of the loader MDeployer by creating a scheduled task named “Perf_sys.”

MagicRAT can persist via scheduled tasks.

Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.

JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.

RedLine Stealer has achieved persistence via scheduled tasks.

OopsIE creates a scheduled task to run itself every three minutes.

Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.

SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.

LitePower can create a scheduled task to enable persistence mechanisms.

Crutch has the ability to persist using scheduled tasks.

RTM tries to add a scheduled task to establish persistence.

BlackByte Ransomware creates a schedule task to execute remotely deployed ransomware payloads.

Sibot has been executed via a scheduled task.

ZxxZ has used scheduled tasks for persistence and execution.

Tarrask is able to create “hidden” scheduled tasks for persistence.

Bazar can create a scheduled task for persistence.

SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.

XLoader can create scheduled tasks for persistence.