# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-Module-WUPS-v1_0-UserGuide

1 June, 2012

- 1
- 2
- 3
- 4
- 5
- 6

SECRET//ORCON//NOFORN
1 Overview
WUPS is a persistence module that uses the Windows Update Service to persist a
payload. When a payload is chosen to use this module, WUPS will install a stub into
the Windows Update service and deploy the payload to the target.
WUPS supports 32- and 64-bit EXE payloads only.
2 Installation
WUPS uses direct registry modification to register a WUPS stub as a Windows
Update component using the user-provided configuration. If the module fails to
install the payload, it will delete any deployed components and remove the registry
modifications.
WUPS can be configured to start the payload immediately by restarting the
Windows Update Service using
sc stop and sc start.
2.1 Configuration
The following fields are configured at build time to specify WUPS's installation
behavior.
Field Default Description
WUPS Key
Name
None Overt key value for WUPS Stub stored in registry
WUPS DLL Path None Path to WUPS DLL on target
If the path does not exist, it is created.
Payload Path None Path to Payload EXE on target started by WUPS DLL
If the path does not exist, it is created.
Start Now True Whether the payload should be started immediately
3 Payload Execution
Whenever the system starts and every 22 hours thereafter, the Windows Update
Service loads a series of DLLs specified by a list in the registry. When the WUPS
stub is loaded and executed by Windows Update, it will start the payload executable
with SYSTEM privileges and spawn a process to maintain its place in the list of
Windows Update DLLs.
Windows Update continues this same behavior whether or not updates have been
disabled by the user.
If the stub is unable to locate the payload, it will uninstall. During uninstallation,
WUPS will remove its registry entry and self delete the stub.
The payload EXE is responsible for deleting itself from the target. The payload must
be able to handle multiple executions.
3
SECRET//ORCON//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6