# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ServiceProxy-v1_1-UserGuide

- 1
- 2
- 3
- 4
- 5

SECRET//NOFORN
3. Stub C stub uses alternate resource ids, and writes the payload to disk during
installation time. Stub C uses a payload file name specified in command line
option or if none specified will use stubname dll filename except with a
stubname{cfg}.extension.
2.4 Uninstall Procedure
Manual
The manual uninstall procedure consists of the following steps:
1. Edit
HKLM\SYSTEM\CurrentControlSet\Services\<PROXIED_SERVICE_NAME>\Param
eters registry and replace with original dll for this service
2. Reboot the target.
3. Delete the stub and payload executables from the filesystem.
del /F <SERVICE_PATH> <PAYLOAD_PATH>
Autonomous
Option 1: The autonomous uninstall procedure consists of the following steps:
1. Delete the payload from the filesystem while the stub is running.
When the stub detects that the payload has been deleted, it will execute the
autonomous uninstall. The stub checks for the payload every 10 seconds. The
autonomous uninstall will perform the following steps:
1. Remove the service proxy from the Windows registry and return entry to
original state.
2. Delete itself from the filesystem.
Option 2: Killfile was configured.
1. Create killfile path on file system.
When the stub detects that the killfile exists, it will execute the autonomous
uninstall. The stub checks for the killfile every 40 seconds. The autonomous
uninstall will perform the following steps:
3. Remove the service proxy from the Windows registry and return entry to
original state.
4. Delete itself from the filesystem.
3 Footprint
File System
- Service Stub Executable, located at a user specified location <STUB_PATH>
- Service Stub Directory, may have been created
- Payload Executable, located at <STUB_PATH>{cpl|mgr|cfg}.{exe|dll} or specified
path
- Payload Directory, may have been created
Registry Keys
Modified
4
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5