# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# GH-ServiceDLL-v1_2-UserGuide

- 1
- 2
- 3
- 4
- 5

SECRET//NOFORN
- Standard Payload Executables are located at (for default Stub A)
<STUB_PATH.tlb> or (for default Stub B) <STUB_PATH>hlp.<exe|dll> depending on
payload type
- Payload Directory, may have been created
- Unhijack Executable, located at a user specified location <UNHIJACK_PATH>
- Unhijack Directory, may have been created
Registry Keys
Created
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ImagePath
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ObjectName
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\DelayedAutoStart
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\ErrorControl
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Start
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Type
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Parameters
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Parameters\ServiceDll
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\Description
- HKLM\SYSTEM\CurrentControlSet\Services\<SERVICE_NAME>\DisplayName
Modified
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs
Modified (during hijack)
- HKLM\SYSTEM\CurrentControlSet\Services\<HIJACKED_SERVICE>\Parameters\ServiceDll
- HKLM\SYSTEM\CurrentControlSet\Services\<HIJACKED_SERVICE>\Parameters\ServiceDll
UnloadOnStop
5
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5