Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
Create Process (CreateProcess_SPF - Spadefoot)
SECRET//NOFORN
OSB Library: Payload Deployment
Module Name: CreateProcess_SPF - Spadefoot
Module Description: Describe how the technique works. All the cool things it does. Describe how cool the module writer is, etc.
PSP/OS Issues: PSPPersonal Security Product (Anti-Virus) issues with this modules should be tested on a per tool basis. This technique can be alerting.
('excerpt' missing)
Sharing Level: Well-known, Liaison
Technique Origin: Windows API
Notes: Any information that could be useful to anyone maintaining the code or using the code. i.e. This module uses Alternate Data Streams which are only available on NTFSNTMicrosoft operating system filesystem (Windows) volumes.
Module Specific Structures:
struct PARAM_SPF
{
WCHAR *wcTargetPath; //The target path of the executable to drop to disk
DWORD dwAttribs; //The attributes of the target payload on disk
WCHAR *wcArgs; //Arguments for the payload on disk
DWORD dwFlags; //Flags for process creation. Default: ...
BOOL bRetHandle; //Specifies whether the module should fill returnHandle or close the handle itself
};
Example Code:
INCLUDE DESCRIPTIVE LABELS FOR EACH MODULE
SECRET//NOFORN