Prepscram

Overview

SoftwareBundler:Win32/Prepscram (cataloged across security vendor telemetry as Trojan.Prepscram, Win32/Prepscram, or Bundler:Win32/Prepscram) is a prolific software bundler, installer wrapper, and adware dropper platform. Distributed primarily through unauthorized freeware mirrors, torrent hosting portals, and malicious search redirect links, Prepscram packages legitimate freeware setup executables inside an evasive multi-step wrapper. During installation, Prepscram uses deceptive dark patterns and concealed opt-out options to covertly install third-party adware, rogue browser toolbars, tracking add-ons, and persistent background downloaders. It systematically alters default browser search engine providers, injects unauthorized promotional ads into active web sessions, and writes registry Run keys to ensure persistent execution across system reboots.

Known aliases

Threat reports may refer to this family under multiple names:

• Prepscram
• SoftwareBundler:Win32/Prepscram
• Trojan.Prepscram
• Win32/Prepscram
• Bundler:Win32/Prepscram
• Prepscram Bundler
• Adware.Prepscram

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Win32 Software Bundler And Pua Lineage

Known Derivatives & Downstream Variants: Softwarebundler:Win32/Prepscram.A · Trojan.Prepscram.Gen · Win32/Prepscram.B

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• a1f2b3c4d5e60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90
• f9e8d7c6b5a403129876543210abcdef9876543210abcdef9876543210abcdef

Delivery vectors

• Third-party freeware download hosting portals
• Repackaged utility software installers
• Deceptive advertising search redirect links

Persistence mechanisms

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\PrepscramHelper
• Browser extension manifests installed in AppData folders

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PREPSCRAM_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prepscram"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "prepscram" ascii wide nocase
        $s2 = "prepscram" ascii wide nocase
        $s3 = "softwarebundler:win32/prepscram" ascii wide nocase
        $s4 = "trojan.prepscram" ascii wide nocase
        $s5 = "win32/prepscram" ascii wide nocase
        $s6 = "bundler:win32/prepscram" ascii wide nocase
        $s7 = "prepscram bundler" ascii wide nocase
        $s8 = "adware.prepscram" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Prepscram (Pua) Execution & Triage
id: b743e686-f12c-50e6-a094-a9df024730a5
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Prepscram malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/prepscram
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.pua
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1189
- attack.t1547_001
- attack.t1176
- attack.t1059_003
- attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_PREPSCRAM_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prepscram tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "prepscram" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately to prevent the secondary, memory-resident payload from establishing C2 communications or moving laterally.
2. Perform a live memory capture (e.g., using WinPmem) before powering down the machine to ensure the hollowed process payload can be extracted.
3. Analyze the initial infection vector (e.g., the spearphishing email) to determine the scope of the targeted attack.
4. Force a password reset for the compromised user and rebuild the OS from a known-good image.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not reboot the machine before capturing memory; the secondary payload exists solely in RAM and will be lost, hindering the investigation.
2. Avoid relying on static file analysis of the PrepScram dropper, as the heavy packing and obfuscation will yield minimal intelligence.

References & External Analysis

• Microsoft Defender Threat Encyclopedia - SoftwareBundler:Win32/Prepscram
• Trend Micro Threat Encyclopedia - Trojan.Prepscram
• Malwarebytes Threat Intelligence - Prepscram PUA Profile
• Search "prepscram" on VirusTotal (External Analysis)
• Search "prepscram" on Any.Run (Sandbox Sandbox)
• Search "prepscram" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Pua)

Explore other documented threats in the same operational category:

• Installcore
• Downloadshield
• Optimizer
• Onesystemcare
• Softonic
• Driverupdate
• Iobit
• Cloudguard

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/prepscram.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.