mshta.exe

mshta.exe runs HTML Applications using the same Trident engine that powered Internet Explorer, but without the browser's security restrictions. Script inside an .hta runs with the privileges of the user, reaches the full file system and COM, and is trusted like any installed application. The genuine binary lives at C:\Windows\System32\mshta.exe, with a 32-bit copy under SysWOW64.

It takes an HTA to run, which can be a local file or a URL, and it can also execute inline script straight from the command line through the javascript: and vbscript: handlers. When legitimate, its parent is usually explorer.exe, a user opening an HTA, or another application launching one it bundles.

On most modern systems mshta runs rarely. What it executes is determined entirely by the HTA or inline script named on its command line.

mshta.exe is a heavily used proxy-execution tool (T1218.005), a staple of phishing chains. The signed binary will run an HTA from a local path or a URL, executing the embedded VBScript or JScript with local trust and nothing dropped to disk (T1059.005, T1059.007). Because the binary is legitimate, path and signature checks pass. The signal is the command line and the parent, classically an Office document spawning mshta http://host/page.hta.

It is also a fileless download stage. The javascript: and vbscript: handlers let mshta run code directly from its command line, and that code routinely fetches and launches the next payload (T1105). A URL, or a javascript:/vbscript: string, in an mshta command line is almost never legitimate.