Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
(S) Pandemic 1.0
1 (U) Tool Summary
(S//NF) Pandemic is a tool which is run as kernel shellcode to install a file system filter
driver. The filter will 'replace' a target file with the given payload file when a remote
user accesses the file via SMB (read-only, not write). Pandemic will not 'replace' the
target file when the target file is opened on the machine Pandemic is running on. The
goal of Pandemic is to be installed on a machine where remote users use SMB to
download/execute PE files.
(S//NF) Pandemic does NOT//NOT make any physical changes to the targeted file on
disk. The targeted file on the system Pandemic is installed on remains unchanged. Users
that are targeted by Pandemic, and use SMB to download the targeted file, will receive
the 'replacement' file.
(S//NF) Pandemic can operate against 32 and 64 bit targets, but 1.0 was only developer
tested against 64-bit targets due to the CONOPs that was in mind at the time.
2 (U) Release Notes
(S) Version 1.0 is the initial version
3 (U) User's Guide
3.1 (U) Change Log
Table 1: (S) Change log (contents SECRET)
Revision Date Author Notes
1.0 17 April,
2014
AED/RDB Initial version.
3.2 (U) File Information
Table 2: (S) File information (contents SECRET//NOFORN)
Pandemic_Builder.exe b0965e3a0f70772a19d98dc3c5ee5f45
Control.dll 221b76333bcac70fc029ffddef0b781b
3.3 (U) File/Registry Access
(S//NF) Pandemic registers a minifilter driver using Windows' Flt* functions. As a
result, FltMgr requires that all drivers registering as minifilters contain certain registry
keys. Pandemic uses the 'Null' service key (on all Windows systems) as its own driver
service key. Pandemic will create 2 sub keys and 3 values under the 'Null' service key in
the registry. These values and sub keys are deleted when Pandemic is uninstalled at the
SECRET//NOFORN
3

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh