# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-Wheat-v1_0-UserGuide

1 June, 2012

- 1
- 2
- 3
- 4
- 5

SECRET//ORCON//NOFORN
1 Overview
Wheat is a persistence module that deploys and installs a Windows Driver payload.
When a payload is chosen that uses this module, Wheat will drop the payload to
disk, install it, and exit immediately.
This module is meant to be used with existing drivers, and simply installs them. It
does not start them or interact with them.
The Wheat Module supports installing 32- and 64-bit drivers.
2 Installation
Wheat uses direct registry modification to register a payload as a Windows driver
using the user-provided configuration. If the module fails to install the payload, it
will delete any deployed components and remove the registry modifications.
2.1 Configuration
The following fields are configured at build time to specify Wheat's installation
behavior.
Field
Defau
lt
Description
Driver Name None Overt name of the Driver registry key.
2.2 Driver Options
The following installation options are used when installing the driver.
Field Value Description
Type 0x01 Specifies the type of the service as 'Driver'
Start 0x02 Specifies the start time of the service as 'Auto Load' during
system startup
Error
Control
0x03 Specifies the service as a Critical process
3 Payload Execution
Whenever the system starts, the Windows OS will run the payload as a Windows
driver. Wheat has no more interaction with the payload/system after installation.
The payload is responsible for deleting itself from the target.
4 Footprint
Wheat writes the unobfuscated payload binary to the target filesystem at
%SYSTEMROOT%\System32\drivers\<DriverName>.sys.
A registry key will be placed in HKLM\System\CurrentControlSet\services\<DriverName>.
3
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5