Overview
overview
6Static
static
3TheForest_...ic.rar
windows10-2004-x64
1TheForest_...ic.rar
windows11-ltsc_2024-x64
1OnlineFix.ini
windows10-2004-x64
1OnlineFix.ini
windows11-ltsc_2024-x64
1OnlineFix.url
windows10-2004-x64
6OnlineFix.url
windows11-ltsc_2024-x64
6SteamOverlay64.dll
windows10-2004-x64
1SteamOverlay64.dll
windows11-ltsc_2024-x64
1TheForest3...ix.ini
windows10-2004-x64
1TheForest3...ix.ini
windows11-ltsc_2024-x64
1TheForest3...ix.url
windows10-2004-x64
6TheForest3...ix.url
windows11-ltsc_2024-x64
6TheForest3...pi.dll
windows10-2004-x64
5TheForest3...pi.dll
windows11-ltsc_2024-x64
5TheForest3...of.dll
windows10-2004-x64
3TheForest3...of.dll
windows11-ltsc_2024-x64
3TheForestV...ix.ini
windows10-2004-x64
1TheForestV...ix.ini
windows11-ltsc_2024-x64
1TheForestV...ix.url
windows10-2004-x64
6TheForestV...ix.url
windows11-ltsc_2024-x64
6TheForestV...64.dll
windows10-2004-x64
5TheForestV...64.dll
windows11-ltsc_2024-x64
5TheForestV...of.dll
windows10-2004-x64
1TheForestV...of.dll
windows11-ltsc_2024-x64
1TheForest_...ix.ini
windows10-2004-x64
1TheForest_...ix.ini
windows11-ltsc_2024-x64
1TheForest_...ix.url
windows10-2004-x64
6TheForest_...ix.url
windows11-ltsc_2024-x64
4TheForest_...64.dll
windows10-2004-x64
5TheForest_...64.dll
windows11-ltsc_2024-x64
5TheForest_...of.dll
windows10-2004-x64
1TheForest_...of.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
TheForest_Fix_Repair_Steam_Generic.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
TheForest_Fix_Repair_Steam_Generic.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
OnlineFix.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
OnlineFix.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
OnlineFix.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
OnlineFix.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
SteamOverlay64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
SteamOverlay64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
TheForest32_Data/Plugins/OnlineFix.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
TheForest32_Data/Plugins/OnlineFix.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
TheForest32_Data/Plugins/OnlineFix.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
TheForest32_Data/Plugins/OnlineFix.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
TheForest32_Data/Plugins/steam_api.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
TheForest32_Data/Plugins/steam_api.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
TheForest32_Data/Plugins/steam_api_of.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
TheForest32_Data/Plugins/steam_api_of.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
TheForestVR_Data/Plugins/OnlineFix.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
TheForestVR_Data/Plugins/OnlineFix.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
TheForestVR_Data/Plugins/OnlineFix.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
TheForestVR_Data/Plugins/OnlineFix.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
TheForestVR_Data/Plugins/steam_api64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
TheForestVR_Data/Plugins/steam_api64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
TheForestVR_Data/Plugins/steam_api64_of.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
TheForestVR_Data/Plugins/steam_api64_of.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
TheForest_Data/Plugins/OnlineFix.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
TheForest_Data/Plugins/OnlineFix.ini
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
TheForest_Data/Plugins/OnlineFix.url
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
TheForest_Data/Plugins/OnlineFix.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
TheForest_Data/Plugins/steam_api64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
TheForest_Data/Plugins/steam_api64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
TheForest_Data/Plugins/steam_api64_of.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
TheForest_Data/Plugins/steam_api64_of.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target TheForest_Fix_Repair_Steam_Generic.rar
- Size 27.2MB
- Sample260722-qq36asstev
- SHA256 c6e326ec50231bff443178fe996b8b809be039d7eb1333a6dcc7addf77d36af2
- MD5 85a8c740698970b13e26161d409487e2
- SHA1 fd0889f907969b6fa3138535a14dcd40c7924ec7
- SHA512 ba5183a6489b1b18fa54c35178a476137ad4dee4793331e5a7804737727e538a778cb71020f70bf5c60285a6b4a41238c370d01c066bfa18adf3974ab75c0cd8
- SSDEEP 786432:WdPAzKaBI3NIAptUcAYsqv9dSwGpTvjqtnq5jOGq1I8:WPAzKRIAEcAhGDGp6nBq8
- TLSH T1EE573372F1BA61BBC2E235F2199AA09F50429DFC7D717D82D27A8C531935D1230CBA36
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 4376 7zFM.exe Token: 35 4376 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4376 7zFM.exe