# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ScheduledTask-v1_1-UserGuide

- 1
- 2
- 3
- 4

SECRET//NOFORN
When the stub detects that the payload has been deleted, it will execute the
autonomous uninstall. The stub checks for the payload every minute. The
autonomous uninstall will perform the following steps:
1. Remove the scheduled task from the Windows Task Scheduler.
2. Delete itself from the filesystem.
Kill File
The kill file uninstall procedure consists of the following steps:
1. Create a file on the file system at path specified for kill file parameter at
build time.
When the stub detects the presence of the kill file, it will execute the kill file
uninstall procedure. The stub checks for the kill file every minute. The uninstall
proceeds through the following steps:
1. Wait half a minute before starting uninstall.
2. Attempt to signal and/or stop the payload for uninstall.
3. Secure delete the payload. If this fails, arrange to delete on reboot.
4. Remove the scheduled task from the Windows Task Scheduler.
5. Remove the kill file.
6. Delete itself from the filesystem.
NOTE: If the payload is a DLL, the stub will attempt to free library. If the payload has
not performed a “safety load” on itself and does not shutdown, it may crash the
host process.
NOTE: If payload is an EXE payload, the payload will be terminated using
TerminateProcess and securely deleted.
NOTE: If the uninstall fails, the kill file remains and the uninstall will be attempted
again on the next boot.
3 Footprint
File System
- Payload Executable, located at a user specified location
- Payload Directory, may have been created
- Task Stub Executable, located at a user specified location
- Task Stub Directory, may have been created
- Scheduled Task XML, located at %SYSTEMROOT%\System32\Tasks\<TASK_NAME>
4
SECRET//NOFORN

- 1
- 2
- 3
- 4