HTML Smuggling Leads to Domain Wide Ransomware - The DFIR
Report
By editor
Published: 2023-08-28 · Archived: 2026-04-02 10:49:00 UTC
We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID
malware. This case, which also ended in Nokoyawa Ransomware, involved the threat actor deploying the final ransomware
only 12 hours after the initial compromise.
This threat actor delivered a password protected ZIP file via HTML smuggling to organizations back in late October, early
November 2022. Within the password protected ZIP file, there was an ISO file that deployed IcedID which led to the use of
Cobalt Strike and ultimately Nokoyawa ransomware. This intrusion also overlaps with the previous Nokoyawa ransomware
case.
Services
Private Threat Briefs: Over 25 private reports annually, such as this one but more concise and quickly published
post-intrusion.
Threat Feed: Focuses on tracking Command and Control frameworks like Cobalt Strike, Metasploit, Sliver, etc.
All Intel: Includes everything from Private Threat Briefs and Threat Feed, plus private events, long-term tracking,
data clustering, and other curated intel.
Private Sigma Ruleset: Features 100+ Sigma rules derived from 40+ cases, mapped to ATT&CK with test
examples.
DFIR Labs: Offers cloud-based, hands-on learning experiences using real data from real intrusions. Interactive labs
are available with different difficulty levels and can be accessed on-demand, accommodating various learning speeds.
Contact us today for a demo!
Case Summary
In early November 2022, the intrusion began with the delivery of an HTML file. We assess with high confidence that the
delivery was via email, as reported in other public reports. This HTML file was using a technique known as HTML
smuggling. This is one of the techniques threat actors have pivoted to since macro control defaults were updated by
Microsoft. Just a month prior, this threat actor was observed using Excel macros in an extremely similar campaign.
Upon the user opening the HTML file, a fake Adobe page was presented and a ZIP file was downloaded. The Adobe lure
includes a password for the ZIP as a way to protect the malicious contents from automated analysis. Inside the ZIP was an
ISO file. Inside the ISO was the malware payload. The only visible file to the user was a LNK file masquerading as a
document.
When the user clicked the LNK file, a series of commands were then executed. These included copying rundll32 and a
malicious DLL from within the ISO to the host, before executing the malware. After loading the malicious DLL, a
connection was made to IcedID command and control servers. The user meanwhile was served a legitimate image of a
finance document.
When the malicious DLL was executed, persistence was also established via a scheduled task on the beachhead host. This
task was set to run the IcedID malware every hour on the host. Initial discovery commands were ran seconds after reaching
out to the command and control server. These commands have been seen in previous reports involving IcedID, including
standard utilities like net, ipconfig, systeminfo, and nltest.
Around three hours after execution of the initial IcedID malware, a cmd process was spawned from IcedID. This new
process began beaconing to a Cobalt Strike server. This Cobalt Strike server was previously observed in a prior Nokoyawa
report. This process was then observed accessing LSASS, likely to access credentials. A quick check of domain admins
using net was also observed.
Hands-on activity then paused for around three hours before the threat actor returned. Using the Cobalt Strike beacon, the
threat actor looked up specific domain administrators using the net utility. Using one of those accounts, the threat actor
initiated a RDP session to move laterally to a domain controller. Using this session, the threat actor copied over a Cobalt
Strike beacon to the domain controller and executed it.
After that, the threat actor continued discovery actions by executing a batch file on the domain controller, which ran the
usual battery of Active Directory discovery commands using AdFind. Upon completion, the results of the discovery
https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Page 1 of 24
commands were archived using 7-Zip. This was followed by the threat actor running a second batch file, which iterated
through the network performing a nslookup for each host in the environment.
About five hours later, the threat actor returned to the domain controller and executed an encoded PowerShell command
which was SessionGopher. SessionGopher is a tool that finds and decrypts saved session information for remote access
tools. The threat actor then logged into additional hosts over RDP, including a backup server and a server with file shares.
On the backup server, the threat actor opened the backup console. While on the file share, they used notepad to review a file
on the host.
The threat actor returned to the domain controller and utilized netscan to perform a network scan. After the scan, both
PsExec and WMIC were used to move files across systems in the network. Key files copied included k.exe and p.bat. These
two files were the ransomware binary and a batch script that would be used to execute the ransomware.
Five minutes after transferring the files to hosts in the domain, the Nokoyawa ransomware binary was executed on a domain
controller. At the same time, PsExec was used to execute the p.bat file starting the ransomware binary on the other hosts in
the domain. The time to ransomware (TTR) was just over 12 hours from the initial infection.
Attribution
In this case we see two different threat actors; the distributor and the hands on keyboard actor. Proofpoint tracks this
distributor as TA551. The hands on keyboard actor is tracked by Microsoft as Storm-0390 which is a “pen test” team
managed by Periwinkle Tempest (formerly tracked as Storm-0193 and DEV-0193).
The ransomware affiliate is seen RDPing into the environment from server name WIN-5J00ETD85P5. This server name
matches the one used by a threat actor from a prior Nokoyawa case. We can see from internet scanning tools, this hostname
is currently active on 78.128.113[.]154 hosted on AS209160 Miti2000 at 4vendeta.com in Bulgaria.
Analysts
Analysis and reporting completed by @v3t0_, @MyDFIR, & @RoxpinTeddy
Initial Access
For this campaign, thread hijacked emails were used to deliver the malicious HTML file. According to Proofpoint, this
campaign was associated to a distribution group they track as TA551. Credits to Proofpoint for the below example.
After downloading and opening the HTML file, it downloaded a password protected ZIP file with a random name. The
password to unzip the file was presented to the user.
The following image shows the HTML file opened in a browser.
https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Page 2 of 24
The ISO file from the zip, when mounted, had 1 visible LNK file (documents-9771) and 3 hidden files: demurest.cmd,
pimpliest_kufic.png and templates544.png.
After execution, a legitimate image is opened to trick the user into thinking nothing is amiss.
https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Page 3 of 24
Execution
The ISO file contained a LNK file, with an icon of an Image, which prompted the user to click on it.When the user opened
the LNK file, the batch script demurest.cmd was executed.
The batch script in the demurest.cmd file did the following:
1. Opened pimpliest_kufic.png, which displayed an image.
2. The Windows utility xcopy was used to copy rundll32.exe to %temp%\entails.exe.
3. Created string “templates544.png” on the runtime and copied it with a random number with a format:
RANDOM_NUM.RANDOM_NUM.
4. templates544.png was an IcedID DLL and was executed via entails.exe.
https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Page 4 of 24
We can see from memory (MemProcFS), cmd executes entails.exe, which executes the IcedID dll by looking at the
CommandLine. We can also see the call chain of cmd->entails.exe with a grand parent process of explorer.exe
Around six hours into the intrusion, 1.dll (Cobalt Strike) was dropped on the beachhead host before being copied to a
domain controller. After 1.dll was transferred to the domain controller, it was executed via rundll32.exe via following
command:
rundll32.exe 1.dll, DllRegisterServer
Persistence
https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Page 5 of 24
IcedID registered a scheduled task to gain persistence on the beachhead host, which ran every hour.
\{E5C1C7DB-E36E-5B16-8E3A-6226D7E53A67}
PT1H
false
2012-01-01T12:00:00
true
true
REDACTED
HighestAvailable
REDACTED
InteractiveToken
IgnoreNew
false
false
false
true
false
PT10M
PT1H
true
false
true
true
false
false
false
PT0S
7
rundll32.exe
"C:\Users\REDACTED\AppData\Local\REDACTED\Izjeubaw64.dll",#1 --oyxo="EdgeDecrease\license.dat
We can also see similar information in memory by reviewing most recently created scheduled tasks:
TaskName TaskPath User CommandLine Parameters T
{E5C1C7DB-E36E-5B16-
8E3A-6226D7E53A67}
\{E5C1C7DB-E36E-5B16-
8E3A-6226D7E53A67}
Author rundll32.exe
“C:\Users\REDACTED\AppData\Local\REDACTED\Izjeubaw64.dll”,#1
–oyxo=”EdgeDecrease\license.dat”
1
1
Privilege Escalation
https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Page 6 of 24
The compromised user had local administrative privileges on their machine which allowed the threat actor to leverage tools
requiring higher permissions.
Defense Evasion
Looking at the contents of the malicious HTML file, we can pick out the HTML smuggling in the code. First, looking at the