hmimysPackerV12hmimys

Hunt Hypothesis

This detection identifies the execution of files packed with UPX version 1.2, a technique frequently employed by adversaries to obscure malicious payloads and evade static analysis. A proactive hunt is essential in Azure Sentinel to uncover stealthy threats that may bypass initial signature-based defenses by leveraging this specific compression method to hide suspicious behavior within legitimate processes.

YARA Rule

rule hmimysPackerV12hmimys
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 95 00 00 00 [149] 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 [4] E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 [4] 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the hmimysPackerV12hmimys detection rule, along with targeted exclusion strategies:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: System Center Configuration Manager (SCCM) or Microsoft Intune agents deploy software updates that utilize the HMI MyS Packer V1.2 compression engine to bundle deployment payloads. When these agents extract and process large update packages on endpoint machines, they trigger the YARA signature.
  • Exclusion/Filter: Create a file path exclusion for the specific agent installation directories (e.g., C:\Program Files\Microsoft Configuration Manager\AdminConsole or C:\Windows\CCM). Additionally, exclude processes with names like ccmsetup.exe, intuneagent.exe, and msiexec.exe when running under the SYSTEM account.

• Scenario: Scheduled Backup Jobs Using Veeam or Acronis

  • Context: Enterprise backup solutions (such as Veeam Agent for Windows or Acronis Cyber Protect) often employ HMI MyS Packer to compress incremental backups before archiving them. During nightly scheduled jobs, the backup engine reads and writes compressed blocks that match the rule’s signature.
  • Exclusion/Filter: Implement a process-based exclusion for VeeamAgent.exe, AcronisBackupService.exe, and vssadmin.exe. Configure the filter to ignore alerts originating from these processes when they are running during defined maintenance windows (e.g., 02:00 – 06:00 local time).

• Scenario: Internal Software Distribution via Chocolatey

  • Context: IT teams frequently use Chocolatey for internal software distribution. Many custom or third-party .choco packages are packaged using the HMI MyS V1