Procedure examples

Elise performs timestomping of a CAB file it creates.

For early Gazer versions, the compilation timestamp was faked.

3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.

EVILNUM has changed the creation date of files.

TAINTEDSCRIBE can change the timestamp of specified filenames.

Shamoon can change the modified time for files to evade forensic detection.

BPFDoor uses the `utimes()` function to change the executable's timestamp.

Attor has manipulated the time of last access to files and registry keys after they have been created or modified.

NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.

The Derusbi malware supports timestomping.

Kobalos can modify timestamps of replaced files, such as ssh with the added credential stealer or sshd used to deploy Kobalos.

HiddenFace can alter timestamps for directory content on targeted machines.

OwaAuth has a command to timestop a file or directory.

Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.

USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.

OSX_OCEANLOTUS.D can use the touch -t command to change timestamps.

Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images.

MacMa has the capability to create and modify file timestamps.

SPAWNCHIMERA has updated the timestamp using the `touch` command.

Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.

PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.

metaMain can change the `CreationTime`, `LastAccessTime`, and `LastWriteTime` file time attributes when executed with `SYSTEM` privileges.

Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.

Gelsemium has the ability to perform timestomping of files on targeted systems.

BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.

FALLCHILL can modify file or directory timestamps.

Empire can timestomp any files or payloads placed on a target machine to help them blend in.

During RedPenguin, UNC3886 used an implant to delete logs associated with unauthorized access to targeted Junos OS devices.

Volt Typhoon has inspected server logs to remove their IPs.

UNC3886 has cleared specific events that contained the threat actor’s IP address from multiple log sources.

SUNBURST also removed the firewall rules it created during execution.

During the SolarWinds Compromise, APT29 removed evidence of email export requests using `Remove-MailboxExportRequest`.

Scattered Spider has manually deleted emails notifying users of suspicious account activity.

APT42 has deleted login notification emails and has cleared the Sent folder to cover their tracks.

LunarMail can set the `PR_DELETE_AFTER_SUBMIT` flag to delete messages sent for data exfiltration.

Goopy has the ability to delete emails used for C2 once the content has been copied.

Misdat is capable of deleting Registry keys used for persistence.

Raspberry Robin uses a RunOnce Registry key for persistence, where the key is removed after its use on reboot then re-added by the malware after it resumes execution.

SplatDropper has deleted its malicious payload and removed its own created service to avoid leaving traces of its presence on victim devices.

PlugX has deleted registry keys that store data and maintained persistence.

S-Type has deleted accounts it has created.

RTM has the ability to remove Registry entries that it created for persistence.

Bazar's loader can delete scheduled tasks created by a previous instance of the malware.

Kapeka will clear registry values used for persistent configuration storage when uninstalled.

SUNBURST removed IFEO registry values to clean up traces of persistence.

IPsec Helper can delete various service traces related to persistent execution when commanded.

Pillowmint can uninstall the malicious service from an infected machine.

GrimAgent can delete previously created tasks on a compromised host.

njRAT is capable of manipulating and deleting registry keys, including those used for persistence.

KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.