name: Winhlp32 Spawning a Process
id: d17dae9e-2618-11ec-b9f5-acde48001122
version: 1
date: '2021-10-05'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
  spawning a child process that loads a file out of appdata, programdata, or temp.
  Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added
  to MetaSploit. WinHlp32.exe is required to display 32-bit Help files that have the
  ".hlp" file name extension. This particular instance is related to a Remcos sample
  where dynwrapx.dll is added to the registry under inprocserver32, and later module
  loaded by winhlp32.exe to spawn wscript.exe and load a vbs or file from disk. During
  triage, review parallel processes to identify further suspicious behavior. Review
  module loads for unsuspecting unsigned modules. Capture any file modifications and
  analyze.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine:
    - '*\\appdata\\*'
    - '*\\programdata\\*'
    - '*\\temp\\*'
    ParentImage: winhlp32.exe
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: False positives should be limited as winhlp32.exe is typically
  not used with the latest flavors of Windows OS. However, filter as needed.
references:
- https://www.exploit-db.com/exploits/16541
- https://tria.ge/210929-ap75vsddan
- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
tags:
  analytic_story:
  - Remcos
  asset_type: Endpoint
  confidence: 100
  impact: 80
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$, and is not typical activity for this process.
  mitre_attack_id:
  - T1055
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 80
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog