# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_1-UserGuide

14 July, 2014

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 21
- 22

SECRET//NOFORN
6. (U) Additional Information
6.1 (U) Startup Delay
(S//NF) Stolen Goods 2.1 uses a start up delay timer when injecting the DLL payload to
ensure process stability. The current timer is set to 5 minutes, which starts when a certain
event is detected on the system during system startup. Following this timer, the stub will
inject the DLL at the first opportunity it gets. This timer is not configurable at build time,
but the developer can recompile a driver with an adjusted wait timer if the need arises.
6.2 (U) System Presence
(S//NF) Stolen Goods 2 will drop at most 1 file to disk (stub DLL). The stub DLL
contains open-source memory load code, and code to initialize a GH1 payload (if used).
It also contains code to contact the stub driver for downloading the decrypted DLL
payload, and for triggering an uninstall.
(S//NF) SG2 saves the stub driver, payload driver (if any) and payload DLL (if any) in
free space on the disk. Usually this space is between the MBR and partition entries, or in
unpartitioned space at the end of the disk. The stub driver is XOR obfuscated. The
payload driver and payload DLL are encrypted with a host-key that is based off
information in the Bios Partition Block in the partition block. If this host-key
information is changed, decryption will fail and SG2 will uninstall immediately.
(S//NF) If SG2 is installed through the shellcode installer, the payload are XOR
obfuscated upon initial installation. After the first reboot, SG2 will figure out that the
payloads are only XOR obfuscated, and will rewrite them to disk encrypted. Therefore,
after the first reboot, all the payloads will be encrypted, regardless of install method.
(S//NF) SG2 will create registry keys for the NULL driver for use with JediMindTricks.
If the payload driver is not JediMindTricks, the registry creation will still occur, and will
cause no side effects on the system. The registry keys are not out of the ordinary; they are
standard registry keys/values needed for a filter driver. The values do not contain file
names or other information that relates to JediMindTricks, SG2, or any paths used by
those tools. The keys are created for the NULL service/driver entry. SG2, if configured
to use the network component, will create an additional registry value under the NULL
service key entry.
(S//NF) During the uninstall process, SG2 will write a registry key to schedule the disk
stub for deletion after the next reboot. This key will be removed by Windows after
reboot.
SECRET//NOFORN
- xiii -

- 1
- 2
…
- 11
- 12
- 13
- 14
- 15
…
- 21
- 22