Chinese Hacktool Set - file Down32.exe

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of the “Down32.exe” utility, a known component of Chinese hacktool sets often used for reconnaissance and data exfiltration in targeted environments. Proactively hunting for this file in Azure Sentinel is critical to identify early-stage intrusion attempts by state-sponsored actors who may leverage low-severity artifacts to establish persistence before escalating their operations.

YARA Rule

rule Dos_Down32 {
	meta:
		description = "Chinese Hacktool Set - file Down32.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
	strings:
		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
		$s6 = "down.exe" fullword wide
		$s15 = "get_Form1" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 137KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set - file Down32.exe detection rule in an enterprise environment:

• Antivirus Endpoint Updates via Chinese Vendors

  • Scenario: Organizations utilizing endpoint protection suites from vendors such as Trend Micro, Kingsoft (K7), or Qihoo 360 often deploy Down32.exe as a background download agent. This executable is responsible for fetching signature updates, definition patches, and minor feature upgrades during business hours or maintenance windows, mimicking the behavior of a legitimate download tool rather than a malicious payload.
  • Suggested Filter: Create an exclusion based on the Parent Process being the specific vendor’s update service (e.g., TrendMicro.exe, KingsoftUpdateService.exe) and restrict the file path to the vendor’s installation directory (e.g., C:\Program Files\Trend Micro\...).

• Software Deployment via SCCM or Intune

  • Scenario: System Administrators frequently use Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune to push Chinese language localization packs, third-party utility suites (like WPS Office), or regional browser updates. The deployment agent often extracts a temporary installer named Down32.exe into the C:\Windows\CCMCache or %TEMP% directory before executing it to install the software package for end-users.
  • Suggested Filter: Exclude file paths located within standard distribution cache directories (e.g., *\SCCM\Cache\*, *\IntuneManagementExtension\*) and filter by User Context where the process is running under a known service account (e.g., NT AUTHORITY\SYSTEM or DOMAIN\DeploySvc).

• Scheduled Maintenance for Chinese ERP/CRM Modules

  ---