# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Angelfire

# Wolfcreek Docs -- Angelfire User Guide

9 November, 2011

- 1
- 2
- 3
- 4
- 5
- 6
…
- 20
- 21

SECRET//20341105
1. (U) Introduction
(TS) Angelfire is an implant comprised of 4 components: Solartime, Wolfcreek,
MagicWand, and BadMFS.
Solartime modifies the partition boot sector to load some kernel code. That kernel code
then modifies the Windows boot process so that when Windows loads boot time device
drivers, an implant device driver can be loaded. The implant driver and Solartime boot
code (aside from the partition boot sector modifications) are kept in a small user-specified
file on disk. This file is encrypted.
Wolfcreek is the kernel code that Solartime executes. Wolfcreek is a self-loading driver,
that once executed, can load other drivers and user-mode applications.
MagicWand is responsible for starting user applications. Any application started by MW
is done without the implant ever being dropped to the file system. In other words, a
process is created and the implant is loaded directly into memory. Currently all processes
will be created as svchost. When viewed in task manager (or another process viewing
tool) all properties of the process will be consistent with a real instance of svchost.exe
including image path and parent process. Furthermore, since the implant code never
touches the file system (aside from the possibility of paging) there is very little forensic
evidence that the process was ever ran.
BadMFS is a covert file system that is created at the end of the active partition. It is used
to store all drivers and implants that Wolfcreek will start. All files are obfuscated to
avoid string or PE header scanning.
2. (S) Implant Forensics
(S) Angelfire has a small forensic footprint.
Table : (S) Angelfire Installer MD5 Signature
Angelfire Installer MD5 Sum
stp.exe (default name
1
)
Pack file
tdbsip.sys (default name)
nvlmi.sys (default name)
Table : (S) Angelfire Footprint Revision
Forensic Entry Purpose Changeable
File: encrypted container file Holds boot code Yes
Boot Sector: partition boot sector modification Holds boot code No
1 (S) The user may rename the Angelfire Installer as necessary without impact to Angelfire's operation.
af+mainrepo+wolfcreek+Docs+Angelfire_UserGuide
4 of 21
SECRET//20341105

- 1
- 2
- 3
- 4
- 5
- 6
…
- 20
- 21