# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Elsa

# ELSA User Manual

27 September, 2013

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 41
- 42

Elsa User Manual.doc
12
SECRET//NOFORN
4.2.10 (U) CONFIG option ServiceDisplayName
(S) The ServiceDisplayName option is used for the SvcHost mode. It specifies the service
display name for the services.msc control panel applet.
4.2.11 (U) CONFIG option ServiceDescription
(S) The ServiceDescription option is used for the SvcHost mode. It specifies the
description field for the services.msc control panel applet.
4.2.12 (U) CONFIG option Guid
(S) The Guid option is used whenever the implant needs a guid. As a dll the tool needs a
mechanism for detecting multiple instances of the implant. Elsa creates a global named
object using the guid value to discern previously running instances. Additionally, when
installed as a scheduled task, DllHost mode, Elsa needs a CLSID with which to register
on the system so Elsa uses the guid value for the CLSID.
4.2.13 (U) CONFIG option WifiSurveyIntervalSeconds
(S) The ISECONDS parameter is the number of seconds between wifi geolocation
periods. The units are in seconds and is required. The interval is measured from the last
time to tool was able to obtain geolocation coordinates.
4.2.14 (U) CONFIG option WifiSurveyInstallDelaySeconds
(S) The DSECONDS parameter is the number of seconds to delay after install. It is
calculated from the dll file creation time. The option is in seconds and is required.
4.2.15 (U) CONFIG option WifiSurveyStartupDelaySeconds
(S) The SSECONDS parameter is the number of seconds to delay after startup. It is
calculate from the time the client is loaded. Using RunDll invocation the start time is
from when the command is issued. Using AppInit invocation the start time is typically
the machine boot for a system process. The option is in seconds and is required.
4.2.16 (U) CONFIG option WifiSurveyFailureBackoffMultiple
(S) The BMULTIPLE parameter is used when the client fails to receive an HTTPS
response during geolocation attempt. The multiple is used adjust the interval to reduce
the geolocation frequency and prevent frequent failed network connections. The
calculation uses integer math and the default value is 10, which tells the system to re-use
the original configured interval.
New Survey Interval Seconds = ISECONDS * BMULTIPLE / 10
Figure 10 - (S) PATCHER Backoff Calculation
(S) Note that this parameter will not be used if the client receives ANY HTTPS response
whatsoever, even if this response does not contain a geo. See the references to captive
portals in the 'Interpreting Errors in ELSA xml files' section.

- 1
- 2
…
- 15
- 16
- 17
- 18
- 19
…
- 41
- 42