HTML Application

HTAs give the developer the features of HTML together with the advantages of scripting languages. They are popular with Microsoft system administrators who use them for system administration from prototypes to "full-scale" applications, especially where flexibility and speed of development are critical.

Execution

An HTA is executed using the program mshta.exe, or alternatively, by double-clicking on an .hta file. This program is installed along with Internet Explorer. mshta.exe executes the HTA by instantiating the Internet Explorer rendering engine as well as any required language engines (such as vbscript.dll).

An HTA is treated like any executable file with extension .exe. When executed via mshta.exe (or if the file icon is double-clicked), it runs immediately. When executed remotely via the browser, the user is asked once, before the HTA is downloaded, whether or not to save or run the application; if saved, it can be run on-demand.

By default, HTAs are rendered as per "standards-mode content in IE7 Standards mode and quirks mode content in IE5 (Quirks) mode", but this can be altered using X-UA-Compatible headers. While Internet Explorer 6 and later enable visual styles on controls by default, HTAs must explicitly enable them by setting the MSThemeCompatible header to yes.

HTAs are dependent on the Trident (MSHTML) browser engine, used by Internet Explorer, but are not dependent on the Internet Explorer application itself. If a user removes Internet Explorer from Windows, via the Control Panel, the MSHTML engine remains and HTAs continue to work. HTAs continue to work in Windows 11.

HTAs are fully supported running in modes equivalent to Internet Explorer versions 5 to 9. Further versions, such as 10 and 11, still support HTAs though with some minor features turned off.

Security considerations

When a regular HTML file is executed, it is confined to the security model of the web browser. This means it is confined to communicating within the same-origin policy, manipulating the page's object model (such as to validate forms or create visual effects), and reading or writing cookies.

On the other hand, an HTA runs in the Local Machine zone as a fully trusted application, with Local Machine Zone Lockdown security mitigations disabled, and therefore has more privileges than a normal HTML file. For example, an HTA can execute external programs, create, edit, and remove files, and modify registry entries. Despite this, it has been observed that querying Active Directory can be subject to security errors.

To customize the appearance of an HTA, an optional tag hta:application was introduced to the HEAD section. This tag exposes a set of attributes that enable control of border style, the program icon, etc., and can be used by scripts to retrieve information such as the argument (command line) used to launch the HTA. Otherwise, an HTA has the same format as an HTML page.

Any text editor can be used to create an HTA. Editors with special features for developing HTML applications may be obtained from Microsoft or from third-party sources.

An existing HTML file with file extension .htm or .html can be opened as an HTA by simply changing the extension to .hta.

mshta.exe and HTA programs are documented as a "system binary proxy execution" technique by the MITRE ATT&CK framework. HTA programs execute with unrestricted privileges as compared to an equivalent page loaded in Internet Explorer, including the ability to instantiate ActiveX controls not marked as "safe for scripting". This renders HTAs valuable in social engineering attacks.

One particular HTA, named 4chan.hta (detected by antiviruses as JS/Chafpin.gen), was widely distributed by users of the 4chan imageboard as a steganographic image. The user was instructed to download this image as an HTA file. When executed, it would cause the computer to automatically spam the website (evading 4chan's CAPTCHA in the process) with alternate variants of itself. It was reported that such attacks were previously delivered in which the user was prompted to save it as a .js file.

First discovered in October 2023, the mshta.exe program has been used by the ClickFix malware campaign, in which the user believes they are solving a CAPTCHA by executing a command in the Run dialog box. mshta.exe accepts a remote URL as an argument, allowing initial malware execution to begin in the HTA environment. The malware quietly downloads and executes a payload, while appearing to the user as a genuine CAPTCHA.

HTA-based malware can be mitigated by disabling mshta.exe through Group Policy.

This is an example of Hello World as an HTML Application.

<HTML> <HEAD> <HTA:APPLICATION ID="HelloExample" BORDER="bold" BORDERSTYLE="complex"/> <TITLE>HTA - Hello World</TITLE> </HEAD> <BODY> <H2>HTA - Hello World</H2> </BODY> </HTML>