I’m not sure I understand your scenario. The first difficulty period takes 4 weeks (if they are fudging timestamps with half the hashrate), or 2 weeks (if they only fudge the timestamp of the last block) and the timestamp on the last block is \sqrt{2}×2 weeks from the start of the attack, i.e. pushed 0.82 weeks into the future. The difficulty is reduced to d_{new} =\frac{1}{\sqrt{2}}×d_{old}. The attacker then needs to start mining by themselves since nobody else will accept their post-dated last block. The second period takes \frac{2 weeks}{0.5 × hashrate}×\frac{d_{new}}{d_{old}} = \frac{2×2}{\sqrt{2}} weeks because the difficulty went down but they have only half the hashrate which is another \sqrt{2}×2 \approx 2.82 weeks.
If that’s exactly the timestamp increase they use in the second difficulty period, the difficulty remains constant. So, now the attacker uses minimal timestamp increases to mine a third difficulty period which takes them another 2.82 weeks. The final timestamp is now about 4.82 weeks from the start of the attack, but the elapsed time is either 7.64 weeks or 9.64 weeks from the start of the attack. The difficulty now increases maximally, which is either 2× or 2.5×, which leads to a new difficulty of 2×\sqrt(2) or 2.5×\sqrt(2). This is bigger than the original difficulty, and the elapsed time is bigger than 6 weeks.
So, I guess it’s not clear to me whether you meant elapsed time, or timestamp progress here, and how much hashrate you assumed the attacker had.