System Time Discovery

The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. [1] [2]

An adversary may gather the system time and/or time zone from a local or remote system. This information may be gathered in a number of ways, such as with Net on Windows by performing net time \hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz. [2] The information could be useful for performing other techniques, such as executing a file with a Scheduled Task [3], or to discover locality information based on time zone to assist in victim targeting.

ID: T1124

Tactic: Discovery

Platform:  Windows

Permissions Required:  User

Data Sources:  Process monitoring, Process command-line parameters, API monitoring

Version: 1.0

Examples

NameDescription
Agent Tesla

Agent Tesla can collect the timestamp from the victim’s machine.[4]

Astaroth

Astaroth collects the timestamp from the infected machine.[5]

Azorult

Azorult can collect the time zone information from the system.[6][7]

BRONZE BUTLER

BRONZE BUTLER has used net time to check the local time on a target system.[8]

Cannon

Cannon can collect the current time zone information from the victim’s machine.[9]

Carbon

Carbon uses the command net time \127.0.0.1 to get information the system’s time.[10]

Epic

Epic uses the net time command to get the system time from the machine and collect the current date and time zone information.[11]

FELIXROOT

FELIXROOT gathers the time zone information from the victim’s machine.[12]

GravityRAT

GravityRAT can obtain the date and time of a system.[13]

HOPLIGHT

HOPLIGHT has been observed collecting system time from victim machines.[14]

InvisiMole

InvisiMole gathers the local system time from the victim’s machine.[15]

Lazarus Group

A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.[16]

MoonWind

MoonWind obtains the victim's current time.[17]

Net

The net time command can be used in Net to determine the local or remote system time.[18]

NOKKI

NOKKI can collect the current timestamp of the victim's machine.[19]

OopsIE

OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.[20]

PowerDuke

PowerDuke has commands to get the time the machine was built, the time, and the time zone.[21]

Proxysvc

As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.[16]

RTM

RTM can obtain the victim time zone.[22]

Shamoon

Shamoon obtains the system time and will only activate if it is greater than a preset date.[23]

T9000

T9000 gathers and beacons the system time during installation.[24]

Turla

Turla surveys a system upon check-in to discover the system time by using the net time command.[11]

UPPERCUT

UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.[25]

Zebrocy

Zebrocy gathers the current time zone and date information from the system.[26]

Zeus Panda

Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.[27]

Mitigation

Benign software uses legitimate processes to gather system time. Efforts should be focused on preventing unwanted or unknown code from executing on a system. Some common tools, such as net.exe, may be blocked by policy to prevent common ways of acquiring remote system time.

Identify unnecessary system utilities or potentially malicious software that may be used to acquire system time information, and audit and/or block them by using whitelisting [28] tools, like AppLocker, [29] [30] or Software Restriction Policies [31] where appropriate. [32]

Detection

Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone. Methods of detecting API use for gathering this information are likely less useful due to how often they may be used by legitimate software.

References

  1. Microsoft. (n.d.). System Time. Retrieved November 25, 2016.
  2. Mathers, B. (2016, September 30). Windows Time Service Tools and Settings. Retrieved November 25, 2016.
  3. Rivner, U., Schwartz, E. (2012). They’re Inside… Now What?. Retrieved November 25, 2016.
  4. The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.
  5. Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved April 17, 2019.
  6. Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.
  7. Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.
  8. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  9. Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.
  10. GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.
  11. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  12. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  13. Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
  14. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.
  15. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  16. Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.
  1. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  2. Microsoft. (n.d.). Net time. Retrieved November 25, 2016.
  3. Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.
  4. Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.
  5. Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.
  6. Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  7. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  8. Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.
  9. Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
  10. ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.
  11. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  12. Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
  13. Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
  14. NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
  15. Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
  16. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.