HTA Files
HTA file, short for HTML Application. An HTA file is like a small desktop app built using familiar web technologies such as HTML, CSS, and JavaScript. Unlike regular web pages that open inside a browser, HTA files run directly on Windows through a built-in component called Microsoft HTML Application Host - mshta.exe process. This allows them to look and behave like lightweight programs with their own interfaces and actions. In legitimate use cases, HTA files serve several practical purposes in Wareville and beyond:
Automating administrative or setup tasks.
Providing quick interfaces for internal scripts.
Testing small prototypes without building full software.
Offering lightweight IT support utilities for daily use.
In short, HTA files were designed as a convenient way to blend the simplicity of the web with the power of desktop applications, a tool that many TBFC’s engineers and elves still use to keep SOC-mas operations running smoothly.
HTA File Structure
Before the defenders of TBFC can recognise suspicious HTA files, it's important to understand how a normal HTA file is built. Luckily, their structure is quite simple, in fact, it's very similar to a regular HTML page. An HTA file usually contains three main parts:
The HTA declaration: This defines the file as an HTML Application and can include basic properties like title, window size, and behaviour.
The interface (HTML and CSS): This section creates the layout and visuals, such as buttons, forms, or text.
The script (VBScript or JavaScript): Here is where the logic lives; it defines what actions the HTA will perform when opened or when a user interacts with it.
HTA files are attractive because they combine familiar web markup with script execution on Windows. In the hands of a defender, they’re a handy automation tool; in the hands of someone wanting to bypass controls, they can be used as a delivery mechanism or launcher.
Common purposes of malicious HTA use:
Initial access/delivery: HTA files are often delivered by phishing (email attachments, fake web pages, or downloads) and run via
mshta.exe.Downloaders/droppers: An HTA can execute a script that fetches additional binaries or scripts from the attacker's C2.
Obfuscation/evasion: HTAs can hide intent by embedding encoded data(Base64), by using short VBScript/JScript fragments, or by launching processes with hidden windows.
Living-off-the-land: HTA commonly calls built-in Windows tools (
mshta.exe,powershell.exe,wscript.exe,rundll32.exe) to avoid adding new binaries to disk.
Inside an HTA, you'll often find a small script that may be obfuscated or encoded. In practice, this tiny script usually does one of two things: downloads and runs a second-stage payload, or opens a remote control channel to let something else talk back to the attacker's server. These lightweight scripts are the reason HTAs are effective launchers, a single small file can pull in the rest of the malware.
Inside an HTA, you'll often find a small script that may be obfuscated or encoded. In practice, this tiny script usually does one of two things: downloads and runs a second-stage payload, or opens a remote control channel to let something else talk back to the attacker's server. These lightweight scripts are the reason HTAs are effective launchers, a single small file can pull in the rest of the malware.
Here is a sample that King Malhare might try to use:
Note: In the example, we've redacted the remote resource and replaced the real link with the REDACTED.txt file for safety. In a real incident, that string would usually point directly to a file hosted on the attacker's C2 domain (for example, a URL under king-malhare[.]com in our SOC-mas story).
After the encoded PowerShell command, we can see three key variables: $U, $C, and $B. Let’s quickly break down what each does:
$U: Holds the decoded URL, the location from which the next script or payload will be fetched.
$C: Stores the content downloaded from that URL, usually a PowerShell script or text instructions.
$B: Converts that content into an executable scriptblock and runs it directly in memory.
Whenever you see a chain of variables like this, try to trace where each one is created, used, and passed. If a variable ends up inside a function like Run, Execute, or Eval, that’s a sign that downloaded data is being executed, a key indicator of malicious activity.
As a summary, the process for reviewing a suspicious HTA can be broken down into three main steps:
Identify the scripts section (VBScript)
Look for encoded data or external connections (e.g. Base64, HTTP requests)
Follow the logic to see what's execute or being sent out.
We reviewed how attackers might use an HTA file for malicious purposes. Now that you’ve seen how HTAs can combine HTML, VBScript, and PowerShell, you’ll apply the same process to analyse a suspicious one. Start by locating script sections (<script language="VBScript">), then identify functions, encoded strings, and any references to URLs or system calls. Decode anything that looks like it is hiding information, then trace how the script uses the results. Now it's your turn to work out what the evil king's minions did.
Within these functions, we want to understand any real actions being performed. These are usually denoted by CreateObject() with our application containing a couple, such as:
InternetExplorer.Application: Allows the application to make an external connection
WScript.Network: Connects to the computer's WScript Networking elements to uncover information
WScript.Shell: Creates a WScript shell that can be used to execute commands on the computer
Last updated