# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### AfterMidnight

# Assassin v1.3 Users Guide

11 June, 2013

- 1
- 2
…
- 8
- 9
- 10
- 11
- 12
…
- 191
- 192

SECRET//ORCON//NOFORN
1.2.2 Deployment Executables
The Deployment Executables provide services to support the deployment of the
Implant Executables, such as process injection and persistence. One of the
Deployment Executables is selected based on the parameters of the operation
and executed on the target computer. The Assassin toolset includes two types of
Deployment Executables: Injection Launchers and Service Installers.
Injection Launchers
Injection Launchers provide persistence and process injection for the Assassin
Implant. The Launcher carries an Implant DLL embedded as a resource, which it
is responsible for deploying.
The Launcher achieves soft persistence by registering itself as a Windows to be
started on boot. Whenever the Launcher runs, it drops an instance of the Implant
DLL to the disk and injects it into an existing Windows SYSTEM process. Once the
Implant has been injected, the Launcher terminates.
Launchers are only capable of injecting Implant DLLs into processes of the same
bitness. The Injection Extractor provides deployment flexibility by allowing
operators to deploy Assassin without prior knowledge of the target environment.
The Extractor carries both the 32- and 64- bit Launchers as resources and runs
the correct executable based on the operating system before self deleting.
Service Installers
Service Installers provide persistence for the Assassin Implant. The Installer
carries an Implant Service DLL embedded as a resource, which it is responsible
for deploying.
The Installer registers the Service DLL as a service that should be run by the
netsvcs svchost on startup. Once the Service DLL is installed, the Installer will
self delete.
The Service Extractor allows operators to deploy Assassin without prior
knowledge of the target environment. The Extractor carries both the 32- and 64-
bit Implant Service DLLs and installs the appropriate Implant based on the
operating system before self deleting.
10
SECRET//ORCON//NOFORN

- 1
- 2
…
- 8
- 9
- 10
- 11
- 12
…
- 191
- 192