Process
hh.exe
hh.exe is the Microsoft HTML Help executable, the program that opens compiled help (.chm) files. Users rarely invoke it directly. Attackers abuse it because a CHM is a bundle of HTML that can carry script, so hh runs attacker code through a signed Microsoft binary.
File identity
Not observed.
Not observed.
Not observed.
Not observed.
Execution context
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Not observed.
Ancestry
Not observed.
Not observed.
Not observed.
Not observed.
Behavior
Not observed.
Not observed.
Not observed.
Not observed.
HH.exe {REMOTEURL:.bat}Download · Download files from urlHH.exe {PATH_ABSOLUTE:.exe}Execute · Execute process with HH.exeHH.exe {REMOTEURL:.chm}Execute · Execute commands with HH.exe
Indicators
Not observed.
Analysis
hh.exe opens and displays compiled HTML Help (.chm) files, the bundled help format made of HTML, images, and a table of contents. Because CHM content is HTML, it can include scripting (and shortcut objects that run commands), which executes when the help file is opened. The genuine binary lives at C:\Windows\System32\hh.exe (with a copy in the Windows directory).
Legitimately, hh.exe opens application help. The .chm it opens and where that file came from are what give an instance meaning.
hh.exe is a system-binary proxy through compiled help files (T1218.001). An attacker builds a malicious .chm whose embedded HTML runs script or a shortcut command, delivers it (often as an email attachment), and when the victim opens it hh.exe executes the payload under a trusted, signed Microsoft process, bypassing application-control rules that allow hh. The recognizable evidence is hh.exe opening a .chm from a download or temp path, or hh.exe spawning a shell.
Because opening legitimate help is normal, the source of the .chm, the parent, and any child process are what separate a help lookup from code execution.
- Image path other than
C:\Windows\hh.exeorC:\Windows\System32\hh.exehigh - Opening a
.chmfromTemp,AppData,Downloads, or an email attachmenthigh - Parent is an Office application, a script host, or a mail clienthigh
- hh.exe spawning
cmd.exe,powershell.exe, or other LOLBINshigh - Outbound network connections from hh.exemed
Telemetry
Not observed.
Not observed.