Description
Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.
Adversaries may use calls like GetTickCount and GetSystemTimeAsFileTime to discover if they are operating within a virtual machine or sandbox, or may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)
Platforms
Associated Software (48)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) has used <code>printf</code> and file I/O loops to delay process execution as part of API hammerin... |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) has the ability to set a hardcoded and randomized sleep interval.(Citation: Proofpoint Bumblebee ... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used a 30 minute delay after execution to evade sandbox monitoring tools.(Citation: TrendMicro U... |
| S1212 | RansomHub | Malware | [RansomHub](https://attack.mitre.org/software/S1212) can sleep for a set number of minutes before beginning execution.(Citation: Group-IB RansomHub FE... |
| S1229 | Havoc | Malware | The [Havoc](https://attack.mitre.org/software/S1229) demon agent can be set to sleep for a specified time.(Citation: Havoc Framework Documentation)(Ci... |
| S0453 | Pony | Malware | [Pony](https://attack.mitre.org/software/S0453) has delayed execution using a built-in function to avoid detection and analysis.(Citation: Malwarebyte... |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) can determine when it has been installed on a host for at least 15 days before downloading the fina... |
| S0671 | Tomiris | Malware | [Tomiris](https://attack.mitre.org/software/S0671) has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.(Citatio... |
| S1138 | Gootloader | Malware | [Gootloader](https://attack.mitre.org/software/S1138) can designate a sleep period of more than 22 seconds between stages of infection.(Citation: Soph... |
| S1086 | Snip3 | Malware | [Snip3](https://attack.mitre.org/software/S1086) can execute `WScript.Sleep` to delay execution of its second stage.(Citation: Morphisec Snip3 May 202... |
| S0561 | GuLoader | Malware | [GuLoader](https://attack.mitre.org/software/S0561) has the ability to perform anti-debugging based on time checks, API calls, and CPUID.(Citation: Me... |
| S0689 | WhisperGate | Malware | [WhisperGate](https://attack.mitre.org/software/S0689) can pause for 20 seconds to bypass antivirus solutions.(Citation: Medium S2W WhisperGate Januar... |
| S0439 | Okrum | Malware | [Okrum](https://attack.mitre.org/software/S0439)'s loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whet... |
| S0565 | Raindrop | Malware | After initial installation, [Raindrop](https://attack.mitre.org/software/S0565) runs a computation to delay execution.(Citation: Symantec RAINDROP Jan... |
| S0512 | FatDuke | Malware | [FatDuke](https://attack.mitre.org/software/S0512) can turn itself on or off at random intervals.(Citation: ESET Dukes October 2019) |
| S0694 | DRATzarus | Malware | [DRATzarus](https://attack.mitre.org/software/S0694) can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to measure function timing.(Ci... |
| S0588 | GoldMax | Malware | [GoldMax](https://attack.mitre.org/software/S0588) has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.(Citation: MST... |
| S1066 | DarkTortilla | Malware | [DarkTortilla](https://attack.mitre.org/software/S1066) can implement the `kernel32.dll` Sleep function to delay execution for up to 300 seconds befor... |
| S0268 | Bisonal | Malware | [Bisonal](https://attack.mitre.org/software/S0268) has checked if the malware is running in a virtual environment with the anti-debug function GetTick... |
| S0660 | Clambling | Malware | [Clambling](https://attack.mitre.org/software/S0660) can wait 30 minutes before initiating contact with C2.(Citation: Trend Micro DRBControl February ... |
References
Frequently Asked Questions
What is T1497.003 (Time Based Checks)?
T1497.003 is a MITRE ATT&CK technique named 'Time Based Checks'. It belongs to the Stealth, Discovery tactic(s). Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time....
How can T1497.003 be detected?
Detection of T1497.003 (Time Based Checks) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1497.003?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1497.003?
While specific threat group attribution may vary, this technique has been observed in various real-world attacks. Check the MITRE ATT&CK website for the latest threat intelligence.