NtSetTimer

Prototype

NTSTATUS NtSetTimer(
  HANDLE              TimerHandle,
  PLARGE_INTEGER      DueTime,
  PTIMER_APC_ROUTINE  TimerApcRoutine,
  PVOID               TimerContext,
  BOOLEAN             ResumeTimer,
  LONG                Period,
  PBOOLEAN            PreviousState
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 62 00 00 00      mov eax, 0x62
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Arms a timer object created by `NtCreateTimer` via `KeSetTimerEx` / `ExpSetTimer` inside ntoskrnl.exe. SSN `0x62` has been stable across every Win10/11 build. `DueTime` is in NT 100-ns units (negative for relative). When `TimerApcRoutine` is non-NULL, on each expiry the kernel queues a *normal user APC* on the **thread that called `NtSetTimer`** — not on any other thread — and the APC fires only when that thread enters an alertable wait. A non-zero `Period` makes the timer recurring (`SetWaitableTimer` semantics); subsequent expiries continue to enqueue APCs until `NtCancelTimer`.

Common malware usage

**The detonator for Ekko-style sleep masks.** The implant builds a chain: NtCreateTimer → NtSetTimer with `TimerApcRoutine` pointing at a `RtlCaptureContext` / `SystemFunction032` / `NtProtectVirtualMemory` ROP gadget series → NtWaitForSingleObject(alertable). On expiry the APC runs each ROP stage in turn: capture context, decrypt RWX implant region, then on next expiry re-encrypt + sleep again. The result is a beacon whose memory image at any *non-active* moment is unreadable to a memory scanner. Foliage, Cronos and Zilean ship variations; Havoc enables an Ekko sleep mask by default. Also abused as a low-noise persistence beacon — periodic timer + small APC that polls C2.

Detection opportunities

ETW Threat Intelligence emits the queued-APC event for the kernel-queued user APC on each expiry, which means *every* tick of an Ekko sleep mask is loggable in principle — though most EDRs throttle volume. The cleanest detection is to memorise that the source `NtSetTimer` callsite RIP lies in unbacked memory, and that the APC routine address lies in the same RWX region — a self-modifying timer arm-and-fire from anonymous memory is extremely rare in benign software. Wake-timer abuse can also be enumerated offline via `powercfg /waketimers`.

Direct syscall examples

; Direct syscall stub for NtSetTimer (SSN 0x62, stable across Win10/11)
NtSetTimer PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 62h          ; SSN
    syscall
    ret
NtSetTimer ENDP

// hTimer was just created with NtCreateTimer(SynchronizationTimer).
// hEvent is the rendezvous the APC will signal at end of the ROP chain.
LARGE_INTEGER due;
due.QuadPart = -(LONGLONG)(60 * 1000 * 10000); // 60s relative

NtSetTimer(hTimer,
           &due,
           (PTIMER_APC_ROUTINE)EkkoStage1, // ROP gadget: encrypt → sleep → decrypt
           (PVOID)hEvent,                  // ctx forwarded as APC arg1
           FALSE,                          // not a wake timer
           0,                              // one-shot; we re-arm at end of chain
           NULL);

// Implant thread then alertably waits on hEvent; APC fires on expiry.
NtWaitForSingleObject(hEvent, TRUE, NULL);

// Beacon every 30s with a small callback that issues an HTTPS check-in.
LARGE_INTEGER due;
due.QuadPart = -(LONGLONG)(30 * 1000 * 10000); // first fire +30s
NtSetTimer(hTimer,
           &due,
           (PTIMER_APC_ROUTINE)BeaconTickApc,
           NULL,
           FALSE,
           30 * 1000,   // period 30s
           NULL);

for (;;) NtWaitForSingleObject(hTimer, TRUE, NULL); // alertable, APC fires each tick

MITRE ATT&CK mappings

• T1027.011Fileless Storagemitre ↗
• T1055.004Asynchronous Procedure Callmitre ↗
• T1029Scheduled Transfermitre ↗