No user's apps? No Registry? Ok, sneak it in Word document then. This delay thing can be applied wholesale, not targeted.

Macro execution is supposed to be disabled on Word/Excel, though I trust that less (and there’s always the issue of some unpatched/zeroday); however, to go through here is more expensive for attackera because much more individual targeting and customization is required.