Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
Registry Keys
Created
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ImagePath
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ObjectName
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\DelayedAutoStart
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ErrorControl
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Start
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Type
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Parameters
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Parameters\ServiceDll
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Description
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\DisplayName
Modified
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs
Modified (during hijack)
- HKLM\SYSTEM\CurrentControlSet\Services\<HIJACKED_SERVICE>\Parameters\ServiceDll
- HKLM\SYSTEM\CurrentControlSet\Services\<HIJACKED_SERVICE>\Parameters\ServiceDll
UnloadOnStop
6
SECRET//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh