Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
Pg. 07
Boot PersistenceBoot PersistenceBoot
Persistence
Should probably remove nickname and just have an internal memload ID.
NO – use nickname
Set:
BYTE ATHENA_CONFIG_TYPE_XXX (dword/time/string/stringlist/buffer)
ULONG value (dword/time)
or
ULONG size (string/stringlist/buffer)
UCHAR buffer
Is there a way to delete the dynamic value and reset to default?
NO – except maybe delete the dyn-data file if that option was selected
Is there a way to disable the setting to override the default but make it inactive? Most
values of 0 are inactive.
NO
Uninstall:
Should this command at least respond saying that the command has been received?
YES
OTHER NOTES:
Each batch job is processed on it’s own thread
What happens if a second batch job comes in while processing the first? run both
Every command has a response.
On reboot – restart batch job – do not wait for beacon
Batch is processed in memory
Memload needs to be in its own batch or higher priority (can we just propagate all memloads to
the top of the batch job?)