Procedure examples

StrifeWater can self delete to cover its tracks.

SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.

FALLCHILL can delete malware and associated artifacts from the victim.

SILENTTRINITY can remove files from the compromised host.

PcShare has deleted its files and components from a compromised host.

CSPY Downloader has the ability to self delete.

Remcos can delete files and folders from victim machines.

Imminent Monitor has deleted files related to its dynamic debugger feature.

cmd can be used to delete files from the file system.

SDelete deletes data in a way that makes it unrecoverable.

TeamPCP Cloud Stealer has the ability to remove all staged files after exfiltration.

Mini Shai-Hulud has deleted all artifacts to include gathered credential archives to reduce disk persistence and detection.

CanisterWorm has deleted itself after execution.

ZeroCleare has the ability to uninstall the RawDisk driver and delete the `rwdsk` file on disk.

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.

RobbinHood disconnects all network shares from the computer with the command net use * /DELETE /Y.

DUSTTRAP can remove network shares from infected systems.

InvisiMole can disconnect previously connected remote drives.

The net use \\system\share /delete command can be used in Net to remove an established connection to a network share.

During Cutting Edge, threat actors changed timestamps of multiple files on compromised Ivanti Secure Connect VPNs to conceal malicious activity.

During the C0032 campaign, TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.

During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.

Mustang Panda has modified file timestamps from the export address table (EAT) in malware to make it difficult to identify creation times.

Rocke has changed the time stamp of certain files.

UNC3886 has used scripts to timestomp ESXi hosts prior to installing malicious vSphere Installation Bundles (VIBs).

APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.

Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.

APT28 has performed timestomping on victim files.

APT5 has modified file timestamps.

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.

BLINDINGCAN has modified file and directory timestamps.

Ninja can change or create the last access or write times.

Stuxnet extracts and writes driver files that match the times of other legitimate files.

SEASHARPEE can timestomp files on victims using a Web shell.

After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.

Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.

Bankshot modifies the time of a file as specified by the control server.

UPSTYLE restores timestamps to original values following modification.

BOOKWORM has modified file timestamps from the export address table (EAT) to make it difficult to discern when the module was created.

PingPull has the ability to timestomp a file.

BlackByte 2.0 Ransomware can timestomp files for defense evasion and anti-forensics purposes.

InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.

CHIMNEYSWEEP can time stomp its executable, previously dating it between 2010 to 2021.

China Chopper's server component can change the timestamp of files.

KeyBoy time-stomped its DLL in order to evade detection.

POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.

MultiLayer Wiper changes timestamps of overwritten files to either 1601.1.1 for NTFS filesystems, or 1980.1.1 for all other filesystems.