Chinese Hacktool Set - file unknown2.exe

Hunt Hypothesis

This detection identifies the execution of unknown2.exe, a known artifact associated with Chinese hacktool sets that may indicate reconnaissance or lateral movement activities by state-sponsored threat actors. Proactively hunting for this file in Azure Sentinel is critical to validate its legitimacy and uncover potential early-stage intrusions before they escalate into more severe incidents, despite the rule’s current low severity rating.

YARA Rule

rule unknown2 {
	meta:
		description = "Chinese Hacktool Set - file unknown2.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
	strings:
		$s1 = "http://md5.com.cn/index.php/md5reverse/index/md/" fullword wide
		$s2 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
		$s3 = "http://www.md5.com.cn" fullword wide
		$s4 = "1.5.exe" fullword wide
		$s5 = "\\Set.ini" fullword wide
		$s6 = "OpenFileDialog1" fullword wide
		$s7 = " (*.txt)|*.txt" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and 4 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file unknown2.exe detection rule, along with recommended filters or exclusions:

• Scenario: Microsoft Office Click-to-Run Background Updates

  • Context: The OfficeClickToRun service frequently spawns temporary processes named unknown2.exe (or similar generic names) during background update checks for the Chinese language pack of Office 365. These files are often located in %ProgramFiles%\Microsoft Office\root\Office16.
  • Filter/Exclusion: Exclude file paths containing \Microsoft Office\ and parent processes named ClickToRun.exe or Update.exe.

• Scenario: Antivirus Real-Time Scanning Engine (e.g., Symantec Endpoint Protection)

  • Context: During scheduled deep scans, legacy Chinese antivirus suites often extract temporary analysis modules to a staging folder. These modules are frequently named unknown2.exe before being executed by the main AV engine (Symantec AntiVirus.exe) and subsequently deleted upon completion.
  • Filter/Exclusion: Create an exclusion for files located in %Temp% or %ProgramData%\Symantec\ where the parent process is a known security vendor executable (e.g., rtvscan.exe, savmain.exe).

• Scenario: Windows Task Scheduler “Software Update” Jobs

  • Context: Enterprise patch management tools (like SCCM or WSUS) often trigger scheduled tasks that download and execute temporary installers. In environments with localized Chinese software, these installers may be named generically as unknown2.exe before renaming themselves to the actual application name during installation.
  • Filter/Exclusion: Filter for events where the “User” account is a system service account (e.g., NT AUTHORITY\SYSTEM, `LOCAL