Virtualization/Sandbox Evasion: Time Based Evasion

Created the Monday 20 March 2023. Updated 1 year, 2 months ago.

Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.

Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: Scheduled Task/Job). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled Multi-Stage Channels to avoid analysis and scrutiny.

Benign commands or other operations may also be used to delay malware execution. Loops or otherwise needless repetitions of commands, such as Pings, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments. Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).

Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.

Technique Identifier

T1497.003

Technique Tags

Defense Evasion Discovery virtual machine environment (VME) sandbox delaying malware functionality sleep commands native system scheduling functionality event based triggers scheduled Multi-Stage Channels API hammering timestamp sampling

Code Snippets

package main

import (
	"time"
	"net"
	"encoding/binary"
	"net/http"
	"fmt"
	"math"
)

func isConnected() bool {
	_, err := http.Get("http://1.1.1.1")
	if err == nil {
		return true
	}
	return false
}

func getNtpTime() time.Time {
	type ntp struct {
		FirstByte, A, B, C uint8
		D, E, F            uint32
		G, H               uint64
		ReceiveTime        uint64
		J                  uint64
	}
	sock, _ := net.Dial("udp", "us.pool.ntp.org:123")
	sock.SetDeadline(time.Now().Add((2 * time.Second)))
	defer sock.Close()
	transmit := new(ntp)
	transmit.FirstByte = 0x1b
	binary.Write(sock, binary.BigEndian, transmit)
	binary.Read(sock, binary.BigEndian, transmit)
	return time.Date(1900, 1, 1, 0, 0, 0, 0, time.UTC).Add(time.Duration(((transmit.ReceiveTime >> 32) * 1000000000)))
}

func evadeTimeAcceleration() bool {
	var maxIdleTime int = 3

	if isConnected() {
		firstTime := getNtpTime()
		time.Sleep(time.Duration(maxIdleTime*1000) * time.Millisecond)
		secondTime := getNtpTime()

		if secondTime.Sub(firstTime).Seconds() > float64(maxIdleTime) {
			return true
		}
	} else {
		firstTime := time.Now()
		time.Sleep(time.Duration(maxIdleTime*1000) * time.Millisecond)

		// math.Floor is used to compensate for processor ticks that is a few micro-seconds
		if math.Floor(time.Since(firstTime).Seconds()) > float64(maxIdleTime) {
			return true
		}
	}
	return false
}

func main() () {
	if evadeTimeAcceleration() {
		fmt.Println("Sandbox detected")
	} else {
		fmt.Println("Sandbox not detected")
	}
}

About Author Open Snippet

Author: Edode / Target Platform: Windows

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Virtualization/Sandbox Evasion: Time Based Evasion, Sub-technique T1497.003 - Enterprise | MITRE ATT&CK®