Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//ORCON//NOFORN
1 Overview
Bermuda is a persistence module that uses a Windows Scheduled Task to persist a
payload. When a payload is chosen to use this module, Bermuda will install a
Windows Scheduled Task and deploy the payload and (if needed) stub executable to
the target.
Bermuda supports 32- and 64-bit EXE, DLL, and GH1 payloads. A 32-bit Bermuda
stub and payload may be installed on a 64-bit machine, but not vice versa.
2 Installation
Bermuda uses the Windows COM interface to create tasks in the Windows Task
Scheduler. The tasks are used to schedule the execution of a Windows executable
based on user-provided configuration. If the module fails to install the payload, it
will delete any deployed components and remove the scheduled task.
2.1 Configuration
The following fields are configured at build time to specify Bermuda's installation
behavior.
Field Default Description
Task Name None Overt name of scheduled task; visible in Task
Scheduler
Task
Description
None Overt description of scheduled task; visible in Task
Scheduler
Task EXE Path None Path to EXE on target started by the scheduled task;
either a payload executable or stub executable
If the path does not exist, it is created.
Payload DLL
Path
None Path to Payload DLL on target loaded and started by
Task EXE stub
If the path does not exist, it is created.
(only used when payload is a DLL)
Max Run Time infinite Maximum run time for the task or infinite
Task Scheduler will try to terminate the Task EXE when
the max run time has elapsed.
Trigger Type at_logo
n
Type of trigger used to schedule task execution; must
be one of:
once run the task a single time
at_startup run the task at system startup
at_logon run the task when a user logs on
Begin Date today Date when the trigger activates
End Date none Date when the trigger deactivates
Start Time 00:00 Time of day when the task runs
(only used for tasks with triggers of type once)
Duration 0 min Time after task starts that trigger remains active; must
3
SECRET//ORCON//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh