Prolock

How Prolock typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via ProLock.

1. T1047 Windows Management Instrumentation Execution

   What they do: ProLock can use WMIC to execute scripts on targeted hosts.

   What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

2. T1197 BITS Jobs ExecutionPersistenceStealth

   What they do: ProLock can use BITS jobs to download its malicious payload.

   What that means: Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks.

3. T1068 Exploitation for Privilege Escalation Privilege Escalation

   What they do: ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.

   What that means: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

4. T1027.003 Steganography Stealth

   What they do: ProLock can use .jpg and .bmp files to store its payload.

   What that means: Adversaries may use steganography techniques in order to prevent the detection of hidden information.

5. T1070.004 File Deletion Stealth

   What they do: ProLock can remove files containing its payload after they are executed.

   What that means: Adversaries may delete files left behind by the actions of their intrusion activity.

6. T1486 Data Encrypted for Impact Impact

   What they do: ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.

   What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

7. T1490 Inhibit System Recovery Impact

   What they do: ProLock can use vssadmin.exe to remove volume shadow copies.

   What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

The note this group leaves on a compromised machine. Click a filename to read it.

Your files have been encrypted by ProLock Ransomware using RSA-2048 algorithm.

   [.:Nothing personal just business:.]

No one can help you to restore files without our special decryption tool.

To get your files back you have to pay the decryption fee in BTC.
The final price depends on how fast you write to us.

   1. Download TOR browser: https://www.torproject.org/
   2. Install the TOR Browser.
   3. Open the TOR Browser.
   4. Open our website in the TOR browser: msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion
   5. Login using your ID [snip]

   ***If you have any problems connecting or using TOR network:
   contact our support by email [email protected].

   [You'll receive instructions and price inside]

The decryption keys will be stored for 1 month.

We also have gathered your sensitive data.
We would share it in case you refuse to pay.

Decryption using third party software is impossible.
Attempts to self-decrypting files will result in the loss of your data.

Ransom-note text from RansomLook, licensed CC BY 4.0.