Technical Information
Triggers a user-defined sigma rule:
- c09dad97-1c78-4f71-b127-7edb2b8e491a
- b29aed60-ebd1-442b-9cb5-16a1d0324adb
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'PAULA Server' = 'C:\HCTC\PAULA\PAULA.exe -InitServer'
Modifies file system
Creates the following files
- C:\hctc\paula\paula.exe
- C:\hctc\paula\temp\paula
- C:\hctc\paula\temp\paulasrvst
- C:\hctc\paula\temp\flagispaulaserverstarting.txt
- C:\hctc\paula\temp\flagterminatepaulaserver.txt
Deletes following files that it created itself
- C:\hctc\paula\temp\flagispaulaserverstarting.txt
- C:\hctc\paula\temp\flagterminatepaulaserver.txt
Miscellaneous
Creates and executes the following
- 'C:\hctc\paula\temp\paula' -Spawned
- 'C:\hctc\paula\temp\paulasrvst' -StartServer -Spawned
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c cls
- 'C:\hctc\paula\temp\paulasrvst' -StartServer -Spawned' (with hidden window)
- 'C:\hctc\paula\temp\paulaserver' -RunServer -Spawned' (with hidden window)
