Procedure examples

BRICKSTORM has embedded delayed-start logic that attempts to circumvent detection for long-term persistence. BRICKSTORM has been observed configured with a “delay” timer built-in that waited for a hard-coded date months in the future before beginning to beacon to the configured C2 domain.

TONESHELL has the ability to pause operations for a specified duration prior to follow-on execution of activities.

DynoWiper has utilized a five-second delay using `Sleep(5000)` between two of the three phases of the attack that involves file overwriting, file deletion, and system reboot.

SystemBC has leveraged the Sleep functions before and after commands to ensure execution using the hexadecimal values within commands to include `Sleep(0x2710u)` that waits 10 seconds, and `Sleep(0xEA60u)` for 60 seconds.

RustyWater has generated random sleep intervals between C2 communication.

PureCrypter has the ability to delay for a specified number of seconds before execution.

MuddyViper has the ability to sleep for a certain amount of time, with the default being one minute.

Fooder has used a custom delay function (`delayExecution(integer)`) and Sleep API calls (`Sleep(integer)`) to slow code execution.

GlassWorm has used a timeout function set to `9e5` which delays execution 900,000 milliseconds or 15 minutes to avoid detection.

AshTag can use a set sleep time to delay C2 beaconing.

PHASEJAM has used the `sleep` command within its code to generate a fake HTML upgrade progress bar that mimics a running process.

SPAWNCHIMERA has used delayed execution to pause for a defined interval before performing environment discovery, repeatedly checking for specific processes, such as the `dslogserver` process, prior to continuing execution.

HIUPAN has used a config file “$.ini” to store a sleep multiplier to execute at a set interval value prior to initiating a watcher function that checks for a specific running process, that checks for removable drives and installs itself and supporting files if one is available.

Shai-Hulud has delayed execution of its larger payloads by forking itself into background process.

Qilin has the ability to delay execution.

UPPERCUT can use a sleep function to delay execution.

TeamPCP Cloud Stealer has leveraged a persistence script that will sleep for five minutes before additional execution.