Resubmissions
11/11/2026, 02:18
261111-crd1xadt6p1011/11/2026, 02:14
261111-cn8q4set4x1011/11/2026, 01:54
261111-cb2f9sts2r1008/09/2026, 17:42
260908-v91lqsvzby1008/09/2026, 14:47
260908-r5xshastaw06/09/2026, 10:46
260906-mtz19shn5s1002/09/2026, 16:53
260902-vefcbaxhjb1002/09/2026, 16:53
260902-vd1xmaxgqd26/04/2026, 11:25
260426-njgydaas6r1024/04/2026, 20:04
260424-ys8gssbv3l10Analysis
- max time kernel
120s - max time network
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
- submitted
11/11/2026, 01:54
General
- Target Ransomware/$uckyLocker.exe
- Size 414KB
- Sample261111-cb2f9sts2r
- SHA256 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
Malware Config
Signatures
- Family: HiddenTear, Cryptear
HiddenTear aka Cryptear is an open-source ransomware available on Github since 2015, with many versions in the wild.
- Detects HiddenTear Ransomware 1 IoCs
- Disables Task Manager via registry modification
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ransomware\$uckyLocker.exe"C:\Users\Admin\AppData\Local\Temp\Ransomware\$uckyLocker.exe"1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4732-0-0x00000000749E2000-0x00000000749E3000-memory.dmp
memory/4732-1-0x0000000000EE0000-0x0000000000F4E000-memory.dmp
memory/4732-2-0x0000000005E90000-0x000000000644A000-memory.dmp
memory/4732-3-0x0000000005970000-0x0000000005A02000-memory.dmp
memory/4732-4-0x0000000005940000-0x000000000594A000-memory.dmp
memory/4732-5-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-37-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-38-0x00000000749E2000-0x00000000749E3000-memory.dmp
memory/4732-39-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-40-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-41-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-42-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-43-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-44-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-45-0x00000000749D0000-0x000000007518C000-memory.dmp
memory/4732-46-0x00000000749D0000-0x000000007518C000-memory.dmp