Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\amsint32] 'ImagePath' = '<DRIVERS>\hmronn.sys'
Creates the following services
- 'IPFILTERDRIVER' <DRIVERS>\ipfltdrv.sys
- 'amsint32' <DRIVERS>\hmronn.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
blocks execution of the following system utilities:
- Windows Firewall
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Modifies file system
Creates the following files
- %WINDIR%\syswow64\drivers\hmronn.sys
Deletes the following files
- %WINDIR%\syswow64\drivers\hmronn.sys
Miscellaneous
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
