Suspicious Microsoft HTML Help (HH.exe) Execution

The Microsoft HTML Help (hh.exe) executable is a legitimate system utility designed to display compiled HTML help (.chm) files. Threat actors frequently abuse this utility to execute malicious code by triggering the display of specially crafted .chm files containing embedded ActiveX controls or scripts. This technique is often used in the initial access phase to bypass security controls by masquerading malicious activity behind a signed, legitimate Windows binary.

Attack Chain

1. An attacker crafts a malicious Compiled HTML (.chm) file.
2. The malicious file is delivered to the target host via spearphishing attachment or downloaded from the web.
3. The file is saved in common user-writable or temporary directories (e.g., AppData, Downloads, or Temp).
4. The attacker or user initiates the execution of the .chm file.
5. The Windows system automatically invokes 'hh.exe' to process the file.
6. The embedded malicious scripts or ActiveX controls execute within the context of 'hh.exe', leading to payload execution.

Recommendation

• Deploy the Sigma rule below to monitor for executions of hh.exe originating from suspicious locations or targeting unconventional file extensions.
• Implement application control or software restriction policies to limit the execution of 'hh.exe' if it is not required for specific business functions.
• Monitor for suspicious child processes spawned by 'hh.exe', which often indicate secondary payload execution.

Impact

Successful exploitation allows for the execution of arbitrary code, potentially leading to unauthorized system access, data exfiltration, or the installation of persistent backdoors and banking trojans.