# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Elsa

# ELSA User Manual

27 September, 2013

- 1
- 2
…
- 14
- 15
- 16
- 17
- 18
…
- 41
- 42

Elsa User Manual.doc
11
SECRET//NOFORN
4.2.6 (U) CONFIG option TargetProcess
(S) The TargetProcess option specifies the module name in which the ELSA dll should
execute. It should be set to match the Mode setting and the PATCHER wizard helps set
this up correctly. The setting is not case sensitive. In AppInit, mode ELSA can be
configured to run inside any particular exe as long as LoadLibrary() is called to load
ELSA. When using AppInit mode the TargetProcess should match the file name of the
exe on the target system e.g. renaming matters.
TargetProcess Description
SvcHost.exe Setting when SvcHost mode is used.
DllHost.exe Setting when DllHost (Task Scheduler) mode is used.
RunDll32.exe Setting when RunDll32 mode is used.
Explorer.exe An example setting for AppInit mode. It could be
almost any valid application such as Calc.exe or
Notepad.exe
Figure 8 - (S) Elsa Target Process Settings.
4.2.7 (U) CONFIG option InstallFromProcess
(S) The InstallFromProcess option is used for alternate installation procedures when
RegSvr32 is not viable. As discussed in the Deployment section, RegSvr32 is used to load
Elsa in the SvcHost and DllHost (Task Scheduler) modes. When the dll is loaded if the
InstallFromProcess setting matches the module name then Elsa can be instructed to install
itself onto the system. This will require the creation of a signal file in the same directory
as the dll. The signal file is a file name with the same name as the dll but with the
‘.install’ file extension. Elsa can also be uninstalled in the same fashion by using the
‘.uninstall’ extension.
Filename Size Description
C:\Windows\System32\elsa.dll 100 KB ELSA dll
C:\Windows\System32\elsa.install 0 ELSA install signal file
Figure 9 - (S) Elsa Alternate Install Procedure
4.2.8 (U) CONFIG option ServiceName
(S) The ServiceName option is used for the SvcHost mode. It specifies the service
registry key name.
4.2.9 (U) CONFIG option ServiceGroup
(S) The ServiceGroup option is used for the SvcHost mode. It specifies the SvcHost
group in which to run ELSA. When choosing a ServiceGroup it may be helpful to view
the list of existing service groups in the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Svchost

- 1
- 2
…
- 14
- 15
- 16
- 17
- 18
…
- 41
- 42