Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
Pg. 07
Boot PersistenceBoot PersistenceBoot
Persistence
Engine
3. Wait States
Each of these items represents a specific Windows event. The main loop will wait for these
events to occur and load the Beacon module to process the specific event. There will only be
once instance of the Beacon module running at any specific time. Once the Beacon logic is
complete, the Engine will unload the Beacon Module. The Engine will expose a thread
management interface to process commands via the Command Module.
• Hibernate – wait a specific period of time after installation before any beacons occur
o Store hibernation date on first boot (unix time/date – Jan 1, 1970 – dword)
o Otherwise value is 0 - uninitialized
• Boot Delay - wait a specific period of time after boot before any beacons occur
o Store the current date of the boot (unix time/date – Jan 1, 1970 – dword)
o Otherwise value is 0 – reset this value after every boot
• Dead Man Delay – wait for a specific period of time between successful beacons to
uninstall
o Store the current date of the last failed beacon (unix time/date – Jan 1, 1970 –
dword)
o Otherwise value is 0 – no failed beacons tracked – set this value during every
successful beacon
• Uninstall date-and-time