ProLocker Ransomware

ProLocker is ransomware first observed in late 2019 that has targeted local government authorities. Previously known as PwndLocker, it was renamed after its creators altered it to prevent free decryption of affected files.

Threat ID:: CC-3385
Category:: Ransomware
Threat Severity:: Low
Threat Vector:
Published:: 9 March 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

Attacks using ProLocker are initiated either through a previous Qakbot infection, with Qakbot acting as a backdoor, or via direct access using exposed or insecure RDP connections. Attacks over RDP will commence once ProLocker's operators gather sufficient information to allow ProLocker to propagate across the network, with ProLocker itself being installed using WMIC. During this time, the operators will attempt to extract sensitive information to later be sold or leveraged against victims.

Once access has been achieved, ProLocker will attempt to terminate range of security and database processes before deleting Volume Shadow Copies to hinder file recovery. it then encrypts all local and network non-system files using an unknown algorithm.

Remediation steps

Type	Step
	If a device on your network becomes infected with ransomware it will begin encrypting files the logged-in user has permission to modify, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages. To reduce the likelihood of infection by ransomware, NHS Digital advises that: Secure configurations are applied to all devices. Security updates are applied at the earliest opportunity. Tamper protection settings in security products are enabled where available. Obsolete platforms are segregated from the rest of the network. IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments. Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts. Administrative accounts are only used for necessary purposes. Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations. Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible. To limit the impact of a ransomware infection, NHS Digital advises that: Critical data is frequently saved in multiple backup locations. At least one backup is kept offline at any time (separated from live systems). Backups and incident recovery plans are tested to ensure that data can be restored when needed. User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary. Infected systems are disconnected from the network and powered down as soon as practicable. Any user account credentials that may have been compromised should be reset on a clean device. Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Type

Step

If a device on your network becomes infected with ransomware it will begin encrypting files the logged-in user has permission to modify, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

To reduce the likelihood of infection by ransomware, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

To limit the impact of a ransomware infection, NHS Digital advises that:

Critical data is frequently saved in multiple backup locations.
At least one backup is kept offline at any time (separated from live systems).
Backups and incident recovery plans are tested to ensure that data can be restored when needed.
User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
Infected systems are disconnected from the network and powered down as soon as practicable.
Any user account credentials that may have been compromised should be reset on a clean device.
Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Indicators of compromise

Main indicators

Filenames

H0w_T0_Rec0very_Files.txt
lock.xml

Extensions

key
pwnd
proLock
pr0Lock
proL0ck

Last edited: 29 June 2021 12:01 pm