Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe

Hunt Hypothesis

This hunt targets adversaries deploying a specific suite of Chinese-origin hack tools (Project1.exe, Generate.exe, and rejoice.exe) that may indicate reconnaissance or lateral movement activities within the environment. Proactively hunting for these binaries in Azure Sentinel is critical to identify potential low-severity footholds before they evolve into more significant threats, especially given their association with known regional threat actors.

YARA Rule

rule _Project1_Generate_rejoice {
	meta:
		description = "Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
		hash1 = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
		hash2 = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
	strings:
		$s1 = "sfUserAppDataRoaming" fullword ascii
		$s2 = "$TRzFrameControllerPropertyConnection" fullword ascii
		$s3 = "delphi32.exe" fullword ascii
		$s4 = "hkeyCurrentUser" fullword ascii
		$s5 = "%s is not a valid IP address." fullword wide
		$s6 = "Citadel hooking error" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Chinese Hacktool Set detection rule, detailing legitimate enterprise activities that trigger Project1.exe, Generate.exe, and rejoice.exe:

• Legacy Chinese Accounting Software Updates (e.g., Kingdee or Yonyou)

  • Scenario: The Finance department utilizes legacy ERP systems like Kingdee K/3 or Yonyou U8. During monthly closing cycles, these applications launch background utilities named Project1.exe and Generate.exe to compile financial reports and generate tax compliance documents. These processes often spawn temporary helper files that match the known Chinese Hacktool signatures.
  • Filter/Exclusion: Create an exclusion for file paths containing \Kingsoft\, \Yonyou\, or \Kingdee\. Additionally, exclude process trees where the parent process is K3Server.exe or U8Service.exe.

• Scheduled Document Conversion Jobs via “Rejoice” Office Suite

  • Scenario: A centralized IT service runs a nightly scheduled task to convert legacy Chinese document formats (CHM, OFD) into PDF for the legal archive. This job utilizes a localized version of an office suite where the conversion engine is named rejoice.exe. The process frequently accesses network shares and writes to local temp directories, mimicking the behavior of a reconnaissance tool.
  • Filter/Exclusion: Exclude rejoice.exe when executed by the “System” or specific service account (e.g., svc_doc_converter) during off-hours (02:00 – 06:00). Add a path filter for execution originating from \Program Files\Rejoice Office Suite\Bin\.

• Internal Development Build Pipelines

  • Scenario: The Software Engineering team uses an internal CI/CD pipeline to build and package applications. Their build