NtDelayExecution

Prototype

NTSTATUS NtDelayExecution(
  BOOLEAN        Alertable,
  PLARGE_INTEGER DelayInterval
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 34 00 00 00      mov eax, 0x34
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Win32 `Sleep` and `SleepEx` are thin wrappers around `NtDelayExecution`. The SSN has been `0x34` across every shipping Windows 10/11 build, making it one of the most predictable syscall numbers in user-mode code. The kernel-side handler routes through `KeDelayExecutionThread` and ultimately blocks on the timer dispatcher. Calls with a NULL or zero relative interval yield the remainder of the thread's quantum — equivalent to `SwitchToThread()`.

Common malware usage

Canonical anti-sandbox / time-based-evasion primitive (MITRE T1497.003). Long, non-alertable sleeps (5–30 minutes) are used to outlast the analysis window of automated sandboxes that snapshot a sample for 1–2 minutes. Modern sleep-mask frameworks (Ekko, Foliage, Cronos, Cobalt Strike's Sleep Mask Kit, Brute Ratel C4) wrap `NtDelayExecution` between an encryption pass and a decryption pass: the beacon's `.text` and heap are encrypted in-place, `NtDelayExecution` is called, then the memory is decrypted on resume, so a memory scan during sleep finds only ciphertext. Combined with an unhooked / patched `ntdll!NtDelayExecution` (direct or indirect syscall) the call also evades user-mode EDR hooks during the dormancy window.

Detection opportunities

Detection is hard because `Sleep` is universal. Behavioral telemetry that helps: anomalous long sleeps from non-interactive processes; sleep loops that follow an `NtQuerySystemTime` call (classic sandbox-time-skip check); thread-call-stack snapshots that show the return address inside RWX/private memory rather than a loaded module (signature of a sleeping beacon). ETW provider `Microsoft-Windows-Kernel-Process` and the Threat Intelligence provider expose thread wait reasons. EDR vendors increasingly snapshot RX private memory regions every N seconds specifically to catch sleep-masked implants between encrypt/decrypt cycles.

Direct syscall examples

; Direct syscall stub for NtDelayExecution (SSN 0x34, all Win10/11 builds)
NtDelayExecution PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 34h          ; SSN
    syscall
    ret
NtDelayExecution ENDP

// Sleep 10 s of wall time, verify the kernel actually slept that long.
// Sandboxes that patch Sleep / accelerate timers will return early.
#include <windows.h>
#include <winternl.h>

extern "C" NTSTATUS NTAPI NtDelayExecution(BOOLEAN, PLARGE_INTEGER);
extern "C" NTSTATUS NTAPI NtQuerySystemTime(PLARGE_INTEGER);

BOOL LooksLikeSandbox(void) {
    LARGE_INTEGER t0, t1, delay;
    NtQuerySystemTime(&t0);
    delay.QuadPart = -10LL * 10000000LL;       // 10 s, relative
    NtDelayExecution(FALSE, &delay);
    NtQuerySystemTime(&t1);
    LONGLONG elapsedSec = (t1.QuadPart - t0.QuadPart) / 10000000LL;
    return elapsedSec < 9;                      // sandbox skipped the sleep
}

// Cargo: windows-sys = "0.59"
use std::arch::asm;

#[unsafe(naked)]
unsafe extern "system" fn nt_delay_execution(
    _alertable: u8,
    _interval: *const i64,
) -> i32 {
    asm!(
        "mov r10, rcx",
        "mov eax, 0x34",
        "syscall",
        "ret",
        options(noreturn),
    );
}

pub fn sleep_seconds(s: i64) {
    // 100 ns units, negative = relative
    let interval: i64 = -s * 10_000_000;
    unsafe { nt_delay_execution(0, &interval as *const _); }
}

MITRE ATT&CK mappings

• T1497Virtualization/Sandbox Evasionmitre ↗
• T1497.003Time Based Evasionmitre ↗
• T1027.011Fileless Storagemitre ↗
• T1106Native APImitre ↗