Loading story…
Kaspersky’s Project TajMahal malware framework was further dissected in public analysis that examined a .NET sample tied to the campaign and later uploaded to VirusTotal. The sample appears focused on maintaining Windows persistence by managing a malicious service and a scheduled task named MaintenancePolicy, while storing configuration data in the registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AdaptiveDisplayBrightness.
The analysis found that an encrypted registry value, seg4, contains RC4-encrypted service configuration data that is decrypted to recover fields including the service name, display name, description, entry point, and a self-destruction timestamp. Researchers also published decompiled and deobfuscated code, extracted indicators of compromise, and a registry configuration decrypter, while noting apparent coding or decompilation anomalies in the malware’s Tools class, including incorrect handling of a service Enum registry key and a DeleteTask routine that invokes Security instead of the more likely intended schtasks.exe.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository was published with decompiled and deobfuscated code for the TajMahal .NET sample, extracted indicators of compromise, and a registry configuration decrypter. The analysis concluded the sample’s main purpose was managing Windows service persistence via a scheduled task and encrypted registry data.
The analyzed sample had been referenced in Kaspersky’s TajMahal report and was later uploaded to VirusTotal. This made the sample available for follow-on public analysis.
Kaspersky previously published an article describing TajMahal as a complex malware framework. The GitHub analysis explicitly references this earlier report as the source that had identified the sample family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said the China-linked **Hafnium** threat actor used a malware tool called **Tarrask** to maintain persistence on compromised Windows systems by abusing scheduled tasks. According to Microsoft Threat Intelligence Center, the malware creates scheduled tasks and related registry entries, then deletes the **Security Descriptor** value from the `TaskCache\Tree` registry path, causing the task to disappear from both **Windows Task Scheduler** and the `schtasks` command-line utility while remaining active on the host. In one observed intrusion, Hafnium created a task named **"WinUpdate"** to restore command-and-control connectivity after interruptions. Microsoft said the activity targeted organizations in the **telecommunications, internet service provider, and data services** sectors between August 2021 and February 2022, showing the group expanding beyond the victim set associated with its earlier Microsoft Exchange exploitation and underscoring its detailed knowledge of Windows internals for stealth and defense evasion.
Jun 29, 2026
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
A public malware-development tutorial and companion GitHub repository demonstrated a Windows persistence method that hijacks the **Certificate Propagation Service** (`CertPropSvc`) by changing the `ServiceDll` value under `HKLM\SYSTEM\CurrentControlSet\Services\CertPropSvc\Parameters` to an attacker-controlled DLL. Because the service loads that DLL when it starts or restarts, the technique can provide durable execution on compromised hosts while blending into a legitimate built-in Windows service; the material notes that administrative privileges are required to modify the `HKLM` registry path. The published proof of concept included simple C/C++ examples and repository files such as `meow.cpp`, `meow.dll`, `meow2.cpp`, `pers.c`, and `pers.exe`. One payload writes a marker string to a file to confirm execution, while another uses `WSAConnect` to establish a reverse shell and launch `cmd.exe`, illustrating how the hijack can move from persistence to interactive command execution if defenders do not detect the altered service DLL path.
Aug 14, 2026