Abuse of Compiled HTML Help Application for Decompilation

The Microsoft HTML Help application (hh.exe) is a legitimate system binary that can be abused by attackers to perform unauthorized actions. By invoking the decompile parameter, an attacker can extract the contents of a Compiled HTML Help (.chm) file to a specified directory. This technique, documented as T1218.001, is often used as a proxy for execution or to unpack malicious payloads staged within seemingly benign help files. APT41 and other actors have historically utilized this mechanism to evade detection by leveraging a trusted, signed Windows binary to facilitate the delivery of secondary malware or configuration files. Defenders should prioritize monitoring for the infrequent use of the decompile switch in their endpoint environments.

Attack Chain

1. Attacker crafts or obtains a malicious CHM file containing secondary payloads or scripts.
2. The malicious file is delivered to the target host via phishing or web download.
3. The attacker executes hh.exe via a command-line interface or script.
4. The command utilizes the -decompile flag: hh.exe -decompile <output_dir> <chm_file>.
5. The contents of the CHM are extracted to the filesystem.
6. The extracted payloads, often scripts or binaries, are executed to achieve the primary goal, such as establishing C2 or persistence.

Impact

Successful abuse of this technique can allow attackers to bypass security restrictions by using a trusted system utility to drop malicious files. This facilitates further system compromise, persistence, and potential data exfiltration. While specific victim counts are not cited in current reports, the technique is a known component in the toolsets of advanced persistent threat groups.

Recommendation

Deploy detection coverage for the command-line usage of hh.exe with the decompile parameter.

• Implement the provided Sigma rule to alert on suspicious process creation events.
• Enable Sysmon or EDR process-creation logging to capture full command-line arguments.
• Audit the use of CHM files within the environment to identify unexpected help file execution.