Microsoft HTML Application (HTA) abuse, part deux
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Javascript - T1059.007 Malware - T1587.001 Malware - T1588.001 Mshta - T1218.005 Powershell - T1059.001 Rundll32 - T1218.011 Software - T1592.002 Tool - T1588.002 Mshta - T1170 Powershell - T1086 Rundll32 - T1085
Show in Graph
Common Information
Type Value
UUID 1d37c73c-3709-487d-92dc-9fa96cf743bf
Fingerprint e4204dbc2d0c4f15
Analysis status DONE
Considered CTI value 0
Text language
Published June 7, 2022, midnight
Added to db Sept. 26, 2022, 9:31 a.m.
Last updated Nov. 18, 2024, 1:25 p.m.
Headline Microsoft HTML Application (HTA) Abuse, Part Deux
Title Microsoft HTML Application (HTA) abuse, part deux
Detected Hints/Tags/Attributes 28/2/7
Source URLs
Redirection Url
Details Source https://www.redcanary.com/blog/microsoft-html-application-hta-abuse-part-deux/
URL Provider
Details Provider Source level domain
Details redcanary.com www.redcanary.com
Attributes
Details Type #Events CTI Value
Details Domain 372 
wscript.shell
Details File 457 
mshta.exe
Details File 36 
c:\windows\system32\mshta.exe
Details File 1 
jo9.reg
Details File 1021 
rundll32.exe
Details File 1212 
powershell.exe
Details File 22 
runonce.exe