Procedure examples

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.

Mustang Panda has modified file timestamps from the export address table (EAT) in malware to make it difficult to identify creation times.

Rocke has changed the time stamp of certain files.

UNC3886 has used scripts to timestomp ESXi hosts prior to installing malicious vSphere Installation Bundles (VIBs).

APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.

Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.

APT28 has performed timestomping on victim files.

APT5 has modified file timestamps.

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.