{
  "family": "scribble",
  "sample_count": 4,
  "category": "ransomware",
  "description": "TrojanDownloader:O97M/Scribble (or similar macro-based droppers) represents a prevalent technique for initial access: the weaponization of Microsoft Office documents (Word, Excel) using malicious Visual Basic for Applications (VBA) macros. Scribble is not the final payload; rather, it is a heavily obfuscated script designed to execute when the user opens the document and enables content, securely downloading a secondary, severe threat like Emotet, Trickbot, or ransomware.<br><br><b>Understanding Macro Downloaders (Scribble)</b><br>To an end-user, the attack arrives as a seemingly urgent email (an invoice, a resume, a shipping notice) with an attached Office document. When opened, the document often displays a 'lure'—a blurry image or fake security warning—instructing the user to click 'Enable Content' or 'Enable Macros' to view the text. For a SOC analyst, this is the classic, highly effective initial breach vector relying entirely on social engineering.<br><br><b>Execution and Payload Delivery Mechanics</b><br>The attack begins with a spear-phishing email (`T1566.001`). The attached document contains malicious VBA code (`T1059.005`). To evade static AV analysis, the macro code is heavily obfuscated (`T1027`), often using string reversal, junk code insertion, and dynamic execution (e.g., using `ExecuteExcel4Macro` or building strings at runtime). Once the user enables macros (`T1204.002`), the VBA script executes. It typically spawns hidden instances of legitimate 'Living off the Land' (LotL) binaries like `powershell.exe`, `cmd.exe`, or `wscript.exe` (`T1059.001`). These system tools are passed obfuscated command-line arguments instructing them to reach out to a hardcoded URL (`T1105`), download the final payload (often an `.exe` or `.dll`), and execute it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on the downloaded payload (frequently ransomware or banking trojans). Host-based IoCs are highly visible in EDR: analysts will see Office applications (`WINWORD.EXE`, `EXCEL.EXE`) exhibiting anomalous behavior, specifically spawning child processes like `powershell.exe` or `cmd.exe` that make outbound HTTP/HTTPS connections. Network IoCs include the outbound connection to the C2 server to retrieve the payload.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.005",
    "T1105",
    "T1027",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic (Malicious Macros)",
      "tactic": "Execution"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Enabling macros)",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Obfuscated VBA code)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the final payload)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent the downloaded payload from executing or spreading laterally.",
    "Examine the EDR process tree to determine exactly what payload `powershell.exe` or `cmd.exe` downloaded and executed.",
    "Extract the malicious macro (using tools like `olevba`) to identify the C2 URLs, and block them enterprise-wide.",
    "Use email security gateways to identify and purge the original phishing email from all other user inboxes to prevent further infections."
  ],
  "what_to_avoid": [
    "Do not allow macros to execute universally across the enterprise; strictly enforce Group Policies that disable macros for files originating from the internet (Mark of the Web).",
    "Avoid relying solely on scanning the `.doc` or `.xls` file; dynamic analysis (sandboxing) is required to observe the PowerShell execution and capture the C2 traffic."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}