NtCancelTimer2

Prototype

NTSTATUS NtCancelTimer2(
  HANDLE                  TimerHandle,
  PT2_CANCEL_PARAMETERS   Parameters
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 96 00 00 00      mov eax, 0x96
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Counterpart to `NtSetTimer2`. Internally `ExpCancelTimer2` removes the `EX_TIMER` from the per-PRCB second-generation queue via `KeCancelTimer2`. If the timer was still pending the kernel returns `STATUS_SUCCESS` and sets `Parameters` to reflect the prior state; if it had already expired and the callback either ran or is in flight, you get `STATUS_TIMER_RESUME_IGNORED`-style semantics — the call cannot un-deliver an APC that is already queued to a thread. Note that `NtCancelTimer2` is remarkably stable across builds (`0x8F` on 1507 → `0x96` on Win11 24H2): the original 1507 SSN survived all the way until the Win11 24H2 syscall-table reshuffle, because the row index reflects sorted alphabetical position relative to insertions/removals — and very little was inserted *before* `Cancel*` for years.

Common malware usage

Used as the symmetric teardown for Timer2-based sleep masks (Cronos, Zilean): right before the implant exits, or when it tears down a temporary mask cycle, `NtCancelTimer2` disarms the timer so the alertable wait completes cleanly. Some kits also use it defensively — if an EDR has begun walking thread-pool timer lists, cancelling the timer early *removes the object from the list* before the scan can correlate the callback pointer with private RWX. Low malware signal on its own.

Detection opportunities

There is no Sysmon event for Timer2 cancellation, and on its own the call is benign. Investigations only consider it as part of a *sequence*: `NtCreateTimer2(HIGH_RESOLUTION) → NtSetTimer2(period ≈ 50 ms, callback in RWX) → NtWaitForSingleObjectEx(Alertable=TRUE) → NtCancelTimer2` repeated tightly is the canonical Timer2 sleep-mask fingerprint. EDR vendors with kernel components (CrowdStrike Falcon, Defender for Endpoint via MAPS) inspect `EX_TIMER` lists directly rather than relying on syscall hooks for this one.

Direct syscall examples

; Direct syscall stub for NtCancelTimer2 (SSN 0x96 on Win11 24H2 / Server 2025)
NtCancelTimer2 PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 96h          ; SSN — drifts; resolve dynamically for portability
    syscall
    ret
NtCancelTimer2 ENDP

// Sleep-mask cycle teardown: disarm the timer and close the handle.
typedef struct _T2_CANCEL_PARAMETERS {
    ULONG Version;
    ULONG Reserved;
} T2_CANCEL_PARAMETERS, *PT2_CANCEL_PARAMETERS;

T2_CANCEL_PARAMETERS cp = { 0 };
NTSTATUS st = NtCancelTimer2(hTimer, &cp);
// If st == STATUS_SUCCESS the timer was still armed; otherwise the APC already fired.
NtClose(hTimer);

MITRE ATT&CK mappings

• T1027.011Fileless Storagemitre ↗
• T1106Native APImitre ↗