> Technique · AutoIt timing-gate sandbox evasion_

~/packetpursuit $ cat /intel/techniques/autoit-timing-gate-sandbox-evasion.md

typetechniqueconfidencehighcreated2026-07-12updated2026-07-12autoitanti-vmevasiondefense-evasionmitre-attck

AutoIt timing-gate sandbox evasion

An anti-debug / anti-sandbox gate implemented in AutoIt malware. The script records the value of GetTickCount before a Sleep call, sleeps for a known duration (commonly 500 ms), then records GetTickCount again. If the observed delta deviates from the expected sleep duration by more than a small tolerance, the script exits without executing the payload. This defeats debuggers that accelerate sleeps and emulators that lack accurate wall-clock timing.

Detection / Fingerprint

Look for AutoIt scripts that:

  1. Call DllCall("kernel32.dll", "dword", "GetTickCount") twice with a Sleep between them.
  2. Compute a delta and compare against a literal or near-literal value (e.g., 500 ± 20).
  3. Exit (Exit or conditional Return) if the comparison fails.

Implementation Patterns Observed

Sample 3424a53f (2024-08)

$Z3439TB5I3 = DllCall("kernel32.dll", "long", "GetTickCount")[0]
DllCall("kernel32.dll", "dword", "sleep", "dword", $B3438TT4PH2)
$L3531KU = DllCall("kernel32.dll", "long", "GetTickCount")[0]
$U3532MTM = $L3531KU - $Z3439TB5I3
If Not (($U3532MTM + 500) >= $B3438TT4PH2 And ($U3532MTM + 4294966796) <= $B3438TT4PH2) Then Exit

4294966796 is 0xFFFFFFEC (-20 in signed 32-bit), so the gate accepts a delta of roughly 480–520 ms around the 500 ms sleep ^[script.au3:36-45].

Sample a4cb4c76 (2024-09)

Uses a similar GetTickCount delta check with Sleep(1000); tolerance is tighter (±10 ms).

Reproduce on Your Own VMs

; timing_gate.au3 — educational reproduction
Func TimingGate($expected_ms)
    Local $t1 = DllCall("kernel32.dll", "dword", "GetTickCount")[0]
    Sleep($expected_ms)
    Local $t2 = DllCall("kernel32.dll", "dword", "GetTickCount")[0]
    Local $delta = $t2 - $t1
    If Not (($delta + $expected_ms) >= $expected_ms And ($delta + 4294967296 - $expected_ms) <= $expected_ms) Then
        ConsoleWrite("Timing gate failed — delta = " & $delta & @CRLF)
        Exit
    EndIf
    ConsoleWrite("Timing gate passed — delta = " & $delta & @CRLF)
EndFunc

TimingGate(500)

Compile with AutoIt3 and run inside a VM. Under a debugger with accelerated sleeps (e.g., x64dbg with "skip sleeps"), the gate will exit.

Defensive Countermeasures

  • Sandbox engines should enforce wall-clock timing for Sleep and NtDelayExecution.
  • EDR behavioral rules: flag sequences of GetTickCount → Sleep → GetTickCount → ExitProcess within the same thread.
  • YARA: look for GetTickCount + Sleep + GetTickCount literals in AutoIt script resources.

Related