Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Server PAULA' = '"C:\HCAP\PAULA\PAULA.exe" -InitServer'
Modifies file system
Creates the following files
- C:\hcap\paula\temp\lastlnch.stat
- C:\hcap\paula\tillstatus.lg
- C:\hcap\paula\paula.exe
- C:\hcap\paula\temp\paula.exe
- C:\hcap\paula\temp\srvstpaula.exe
- C:\hcap\paula\temp\lktsip.dat
- C:\hcap\paula\temp\ipss.flg
- C:\hcap\paula\temp\tps.flg
- C:\hcap\paula\temp\serverpaula.exe
- C:\hcap\paula\temp\detlgflg.flg
Deletes the following files
- C:\hcap\paula\temp\ipss.flg
Network activity
Connects to
- '<LOCALNET>.5.10':445
- '<LOCALNET>.5.10':139
- '<LOCALNET>.5.10':80
UDP
- DNS ASK 10.#.#.10.in-addr.arpa
Miscellaneous
Creates and executes the following
- 'C:\hcap\paula\temp\paula.exe' -Spawned
- 'C:\hcap\paula\temp\srvstpaula.exe' -StartServer -Spawned
- 'C:\hcap\paula\temp\serverpaula.exe' -RunServer -Spawned
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cls
- 'C:\hcap\paula\temp\srvstpaula.exe' -StartServer -Spawned' (with hidden window)
- 'C:\hcap\paula\temp\serverpaula.exe' -RunServer -Spawned' (with hidden window)
