Chinese Hacktool Set - file hkmjjiis6.exe

Hunt Hypothesis

This hypothesis posits that adversaries are deploying the specific Chinese hacktool hkmjjiis6.exe to establish persistence or conduct reconnaissance within the Azure environment. Proactive hunting for this artifact is critical because its presence often indicates early-stage tooling deployment by threat actors targeting Chinese interests, allowing the SOC team to identify and investigate potential lateral movement before it escalates into a high-severity incident.

YARA Rule

rule hkmjjiis6 {
	meta:
		description = "Chinese Hacktool Set - file hkmjjiis6.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
	strings:
		$s1 = "comspec" fullword ascii
		$s2 = "user32.dlly" ascii
		$s3 = "runtime error" ascii
		$s4 = "WinSta0\\Defau" ascii
		$s5 = "AppIDFlags" fullword ascii
		$s6 = "GetLag" fullword ascii
		$s7 = "* FROM IIsWebInfo" ascii
		$s8 = "wmiprvse.exe" ascii
		$s9 = "LookupAcc" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 70KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file hkmjjiis6.exe detection rule, tailored for an enterprise environment:

• Enterprise Antivirus Deployment via SCCM/MECM

  • Scenario: The System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager deploys a Chinese-language security patch or the “Hikvision” client update package to a specific OU of regional offices. During the installation, hkmjjiis6.exe is extracted and executed as part of the legitimate installer payload (setup.exe) rather than being dropped directly by an unknown process.
  • Filter/Exclusion: Create an exclusion for hkmjjiis6.exe when the parent process is ccmexec.exe (SCCM) or msiexec.exe, and the file path resides within the standard program installation directory (e.g., C:\Program Files\Hikvision\...).

• Scheduled Maintenance Job for Remote Desktop Optimization

  • Scenario: A scheduled Task Scheduler job named “Weekly_RDP_Cleanup” runs every Sunday at 02:00 AM. This task launches a custom script that invokes hkmjjiis6.exe to optimize remote desktop sessions and clear temporary cache files for the IT Helpdesk team. The file is digitally signed by a known Chinese vendor (e.g., Kingsoft or Tencent) and runs under the context of the “Local System” account.
  • Filter/Exclusion: Exclude alerts where the process hkmjjiis6.exe is launched by svchost.exe with the service name Schedule, provided the file’s digital signature matches a trusted certificate authority (e.g., DigiCert or GlobalSign) and the file hash remains static over 30 days.

• **Third-Party Endpoint Encryption