Full Report
Dive in Recent ProLock's Big Game Hunting
Analysis Summary
# Tool/Technique: ProLock
## Overview
ProLock is a ransomware variant involved in "Big Game Hunting" (BGH) operations. It is the successor to the PwndLocker ransomware. It is typically deployed manually by threat actors after gaining a foothold in a corporate network, focusing on high-value targets to demand significant ransom amounts (recorded up to $1 million USD).
## Technical Details
- **Type:** Malware family (Ransomware)
- **Platform:** Windows
- **Capabilities:** Data encryption, antivirus disabling, backup deletion, data exfiltration.
- **First Seen:** Early 2020 (transitioned from PwndLocker).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- T1566 - Phishing (via Qakbot)
- **[TA0002 - Execution]**
- T1059.001 - PowerShell
- T1047 - Windows Management Instrumentation
- T1197 - BITS Jobs
- **[TA0003 - Persistence]**
- T1053.005 - Scheduled Task
- **[TA0005 - Defense Evasion]**
- T1562.001 - Disable or Modify Tools (Antivirus)
- T1027 - Obfuscated Files or Information (Disguised payloads in JPG/BMP)
- **[TA0007 - Discovery]**
- T1082 - System Information Discovery
- **[TA0009 - Collection]**
- T1005 - Data from Local System
- **[TA0010 - Exfiltration]**
- T1567.002 - Exfiltration to Cloud Storage (via Rclone)
- **[TA0040 - Impact]**
- T1486 - Data Encrypted for Impact
- T1490 - Inhibit System Recovery (Wiping backups)
## Functionality
### Core Capabilities
- **Dual-Component Execution:** Utilizes a batch file launcher and a separate file containing the disguised payload.
- **Data Encryption:** Encrypts files on the target system to extort a ransom.
- **System Recovery Inhibition:** Specifically targets and wipes backups from servers to ensure victims cannot restore data without the decryptor.
- **Persistence:** Often deployed via Group Policy or scheduled tasks once administrative access is gained.
### Advanced Features
- **Steganography-lite/Masquerading:** The ransomware payload is often hidden inside non-executable file formats like `.JPG`, `.BMP`, or `.CSV` to evade simple file-filter detections.
- **Living-off-the-Land (LotL):** Heavy reliance on native Windows tools (BITS, WMIC, PowerShell) and legitimate third-party tools (Rclone) to minimize the footprint of custom malware.
## Indicators of Compromise
- **File Names:** `svchost.exe` (masqueraded Rclone or launcher), various `.bat` files in `%ALLUSERSPROFILE%`.
- **File Extensions:** Disguised payloads as `.jpg`, `.bmp`, or `.csv`.
- **Network Indicators:** Adversary-controlled servers used for BITS downloads (specific IPs/domains are case-dependent and should be monitored for BITS traffic).
- **Behavioral Indicators:**
- Execution of Rclone for large-scale data transfer to cloud providers.
- PowerShell scripts decoding large blocks of data.
- Use of `wmic.exe` to execute commands on remote hosts.
- Batch scripts disabling Windows Defender or other AV products.
## Associated Threat Actors
- **Qakbot (Quakbot/Qbot) Operators:** Often used as the initial delivery mechanism.
- **ProLock Operators:** Specifically linked to Big Game Hunting campaigns.
## Detection Methods
- **Behavioral detection:** Monitor for unauthorized use of `rclone.exe`, especially when renamed. Watch for BITS jobs originating from unexpected processes.
- **Process Monitoring:** Detect `wmic.exe` and `powershell.exe` execution patterns involving remote script execution or base64 encoded commands.
- **Integrity Checking:** Monitor `%ALLUSERSPROFILE%` for the creation of unusual batch files or high-frequency file modifications (encryption).
## Mitigation Strategies
- **Prevention measures:** Implement strict application whitelisting to prevent the execution of unauthorized tools like Rclone.
- **Hardening recommendations:**
- Restrict the use of PowerShell and WMIC to administrative users only.
- Disable BITS for non-administrative users if not required.
- Implement offline, immutable backups that cannot be wiped via domain-level administrative access.
- **Identity Management:** Enforce Multi-Factor Authentication (MFA) to prevent lateral movement following a Qakbot infection.
## Related Tools/Techniques
- **PwndLocker:** The direct predecessor to ProLock.
- **Qakbot:** Frequently used for initial access and dropping the ProLock payload.
- **Rclone:** Legitimate tool repurposed for data exfiltration.
- **BITS (Background Intelligent Transfer Service):** Used for stealthy downloading of the ransomware payload.