{
  "family": "prepscram",
  "sample_count": 3130,
  "category": "trojan_generic",
  "description": "TrojanDropper:Win32/PrepScram is a highly obfuscated, targeted trojan dropper utilized to securely deliver and execute secondary payloads while evading traditional antivirus defenses.<br><br><b>What is PrepScram?</b><br>For the end-user, PrepScram is entirely invisible, operating silently in the background. For threat intelligence analysts, PrepScram represents a sophisticated staging mechanism. It is heavily packed and utilizes dynamic API resolution to hide its true intentions from static scanners. Its sole purpose is to establish a foothold, decrypt a hidden payload (often embedded within its own binary or downloaded securely), and execute it directly in memory.<br><br><b>Infection Vectors & Threat Hunting</b><br>PrepScram is frequently utilized in highly targeted spearphishing campaigns, often dropped by weaponized Office documents containing malicious VBA macros. Upon execution, PrepScram performs extensive environment checks to ensure it is not running in a sandbox or debugger (e.g., checking for VMware/VirtualBox artifacts or specific EDR hooks). Once validated, it allocates memory in a legitimate process (like <code>explorer.exe</code>) and uses techniques like Process Hollowing to inject and execute the final payload, which is often a RAT or banking trojan.<br><br><b>Forensic Analysis & Impact</b><br>The impact of PrepScram is entirely dependent on the secondary payload it delivers. Incident responders should hunt for EDR alerts related to 'Process Hollowing' or 'Suspicious Memory Allocation'. Memory forensics is absolutely critical; analysts must dump the memory of the hollowed process to extract the unencrypted secondary payload, as it never touches the disk. Dropped, highly entropic (packed) files in the <code>%AppData%</code> directory are also strong IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1129",
    "T1105",
    "T1055.012",
    "T1497.001",
    "T1027.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1129",
      "name": "Shared Modules",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent the secondary, memory-resident payload from establishing C2 communications or moving laterally.",
    "Perform a live memory capture (e.g., using WinPmem) before powering down the machine to ensure the hollowed process payload can be extracted.",
    "Analyze the initial infection vector (e.g., the spearphishing email) to determine the scope of the targeted attack.",
    "Force a password reset for the compromised user and rebuild the OS from a known-good image."
  ],
  "what_to_avoid": [
    "Do not reboot the machine before capturing memory; the secondary payload exists solely in RAM and will be lost, hindering the investigation.",
    "Avoid relying on static file analysis of the PrepScram dropper, as the heavy packing and obfuscation will yield minimal intelligence."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}