# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_0-UserGuide

14 January, 2014

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11

SECRET//NOFORN
the target machine. Some machines can have 6-7 MB of unpartitioned space,
others may only have 1 MB (contiguous).
• 104 – The installer failed to write the stub DLL to disk. The likely cause of
this is that the target path exists already. Example: Tried to lay down stub
DLL to c:\windows\system32\msxml6.dll but msxml6.dll already exists in that
directory.
• 6 – The active partition is not an NTFS partition. Not safe to install in this
case.
(S//NF) Other return errors for the shellcode installer, and for the Grasshopper installer,
describe many other issues that could arise. If you get a code not listed above, the
developer can look it up for you.
3.5 (U) Installation Confirmation
(S//NF) To confirm an installation of Stolen Goods 2 which persisted a DLL payload,
simply check that the stub DLL was laid down on disk at the target location.
(S//NF) To confirm that a driver-only payload installation of SG2 worked, you'll have to
rely on the return codes of the installers. Driver-only installs write nothing to the file
system on disk, and verification of installation would require inspection of the disk using
something like WinHex. You could try to re-install again and see if you get a previous
install return code (900 for the shellcode installer).
4. (U) Uninstall
(S//NF) If a GH1 payload is being persisted, the GH1 payload can trigger an uninstall.
Otherwise, two DLLs have been provided to trigger an uninstall event. The DLLs
Uninstall32 and Uninstall64 are simple Fire and Forget DLLs which tell SG2 to uninstall.
A zero return value indicates successful uninstall. Non-zero represents an error. If a
non-zero error value is returned, the developer look up and tell you the issue when given
the error code. SG2 prevents double uninstalls, so there is no penalty in accidentally
running the uninstall DLL more than once.
(S//NF) If a payload DLL was used, the stub DLL on disk will be queued for deletion
after the next reboot. All other artifacts (stub driver, payload driver, payload DLL) are
wiped from disk during the uninstall process (3x overwrite with zeros).
(S//NF) Note: GH1 uninstalls can take some time. During testing, it was possible to
trigger the GH1 uninstall through something like IcePick, and restart the system before
IcePick had a chance to notify the SG2 stub to uninstall. Typically, the GH1 uninstall
will take 30-60 seconds to complete.
5. (U) Additional Information
5.1 (U) System Presence
SECRET//NOFORN
- ix -

- 1
- 2
…
- 7
- 8
- 9
- 10
- 11