NtDelayExecution

Created the Saturday 17 August 2024. Updated 4 weeks, 2 days ago.

NtDelayExecution can be used to delay the execution of the calling thread. NtDelayExecution accepts a parameter "DelayInterval", which is the number of milliseconds to delay. Once executed, NtDelayExecution "pauses" execution of the calling program whuch can cause a timeout of the sandbox or loss of control in a debugger.

Additionally, some higher level WinAPI functions invoke NtDelayExeuction. For example, the WinAPI function Beep, which plays an audible tone for a specified number of milliseconds, calls into NtDelayExecution. In this manner, malware can invoke the Beep function to similarly cause a delay in the program execution.

Technique Identifiers

U1344 U0133

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

Code Snippets

Description

The following code snippet demonstrates two methods for introducing delays in a Windows environment. The first method uses NtDelayExecution, while the second employs the Beep function.

int main() {
    
    bool alertable = 0; // Thread alertable state. 0 = thread cannot cannot break on call to NtAlertThread.
    int duration = 60000; // Duration of the delay in milliseconds

    NtDelayExecution(alertable, duration)
    return 0;
}

// ---

int main() {
    
    int frequency = 0; // Frequency of the beep in hertz (this will likely be "0" if the malware doesn't actually want to invoke the beep sound!)
    int duration = 60000; // Duration of the beep in milliseconds

    Beep(frequency, duration)
    return 0;
}

Contributors

Kyle Cucci (d4rksystem)

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.