Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
Pg. 07
Boot PersistenceBoot PersistenceBoot
Persistence
o Hard coded time when to uninstall (unix time/date – Jan 1, 1970 – dword)
• Interval – wait a specific period of time between beacons (with jitter %)
NOTE:This value is affected by the boot delay.
o Store the value of the next beacon
o Otherwise value is 0 – beacon is ready
• Kill File
o Detect the creation of this file and uninstall NOW
o Otherwise only check the directory on boot and during change notification
4. Implementation
Timers are going to be implemented with WaitableTimers. (check if these work in a service)
File detection is going to be implemented with ChangeNotifications.