Hide Navigation Hide TOC

ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)

ProLock is a ransomware strain that has been used in Big Game Hunting (BGH) operations since at least 2020, often obtaining initial access with QakBot. ProLock is the successor to PwndLocker ransomware which was found to contain a bug allowing decryption without ransom payment in 2019.(Citation: Group IB Ransomware September 2020)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)	Malware	1
Inhibit System Recovery - T1490 (f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a)	Attack Pattern	ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)	Malware	1
Steganography - T1027.003 (c2e147a9-d1a8-4074-811a-d8789202d916)	Attack Pattern	ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)	Malware	1
Exploitation for Privilege Escalation - T1068 (b21c3b2d-02e6-45b1-980b-e69051040839)	Attack Pattern	ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)	Malware	1
Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0)	Attack Pattern	ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)	Malware	1
BITS Jobs - T1197 (c8e87b83-edbb-48d4-9295-4974897525b7)	Attack Pattern	ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)	Malware	1
ProLock - S0654 (471d0e9f-2c8a-4e4b-8f3b-f85d2407806e)	Malware	Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055)	Attack Pattern	1
File Deletion - T1070.004 (d63a3fb8-9452-4e9d-a60a-54be68d5998c)	Attack Pattern	Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69)	Attack Pattern	2
Steganography - T1027.003 (c2e147a9-d1a8-4074-811a-d8789202d916)	Attack Pattern	Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	2