Malware analysis SteamSetup.exe Malicious activity | ANY.RUN

Add for printing

File name:	SteamSetup.exe
Full analysis:	https://app.any.run/tasks/348e8b76-68fa-48fc-a580-e1b21cdc6adf
Verdict:	Malicious activity
Analysis date:	April 12, 2019, 08:33:12
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:	81448C2E730B50B597BBD5E43007CE6A
SHA1:	4B1B85EC2499A4CE07C89609B256923A4FC479E5
SHA256:	3BC6942FE09F10ED3447BCCDCF4A70ED369366FEF6B2C7F43B541F1A3C5D1C51
SSDEEP:	24576:QDliBd5TyliR0gWwOvTCU1z3zk51iq449nkU0/1COmcrOqpXzzE2YeshfLKB7:QD8tylwXoTCWi1iq1nkU09lRENhJLKB7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Loads dropped or rewritten executable
  - SteamSetup.exe (PID: 1300)
- Changes the autorun value in the registry
  - SteamSetup.exe (PID: 1300)
- Application was dropped or rewritten from another process
  - steam.exe (PID: 2580)
  - steamservice.exe (PID: 1088)
  - ns707D.tmp (PID: 3140)
SUSPICIOUS
- Creates files in the program directory
  - SteamSetup.exe (PID: 1300)
  - steam.exe (PID: 2580)
- Executable content was dropped or overwritten
  - SteamSetup.exe (PID: 1300)
  - steamservice.exe (PID: 1088)
- Creates a software uninstall entry
  - SteamSetup.exe (PID: 1300)
- Starts application with an unusual extension
  - SteamSetup.exe (PID: 1300)
- Modifies the open verb of a shell class
  - steamservice.exe (PID: 1088)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2016:07:25 02:55:51+02:00
PEType:	PE32
LinkerVersion:	6
CodeSize:	25088
InitializedDataSize:	141824
UninitializedDataSize:	2048
EntryPoint:	0x33b6
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	2.10.91.91
ProductVersionNumber:	2.10.91.91
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Bulgarian
CharacterSet:	Windows, Cyrillic
FileDescription:	Steam
FileVersion:	2.10.91.91
LegalCopyright:	© Valve Corporation
ProductName:	Steam

Summary

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	25-Jul-2016 00:55:51
Detected languages:	Bulgarian - Bulgaria Chinese - PRC Chinese - Taiwan Czech - Czech Republic Danish - Denmark Dutch - Netherlands English - United States Finnish - Finland French - France German - Germany Greek - Greece Hungarian - Hungary Italian - Italy Japanese - Japan Korean - Korea Norwegian - Norway (Bokmal) Polish - Poland Portuguese - Brazil Portuguese - Portugal Romanian - Romania Russian - Russia Spanish - Spain (Traditional sort) Swedish - Sweden Thai - Thailand Turkish - Turkey Ukrainian - Ukraine
FileDescription:	Steam
FileVersion:	2.10.91.91
LegalCopyright:	© Valve Corporation
ProductName:	Steam

DOS Header

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x000000C8

PE Headers

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	5
Time date stamp:	25-Jul-2016 00:55:51
Pointer to Symbol Table:	0x00000000
Number of symbols:	0
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_RELOCS_STRIPPED

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x0000615D	0x00006200	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.45023
.rdata	0x00008000	0x000013A4	0x00001400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.163
.data	0x0000A000	0x00020338	0x00000600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.9824
.ndata	0x0002B000	0x00036000	0x00000000	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	0
.rsrc	0x00061000	0x00012868	0x00012A00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.2422

Resources

Title	Entropy	Size	Codepage	Language	Type
1	5.28717	1069	UNKNOWN	English - United States	RT_MANIFEST
2	5.48879	9640	UNKNOWN	English - United States	RT_ICON
3	4.72962	7336	UNKNOWN	English - United States	RT_ICON
4	5.942	4264	UNKNOWN	English - United States	RT_ICON
5	4.91233	3240	UNKNOWN	English - United States	RT_ICON
6	4.19177	1384	UNKNOWN	English - United States	RT_ICON
7	5.69139	1128	UNKNOWN	English - United States	RT_ICON
8	5.71619	872	UNKNOWN	English - United States	RT_ICON
9	2.35861	176	UNKNOWN	English - United States	RT_ICON
103	2.77822	132	UNKNOWN	English - United States	RT_GROUP_ICON

Imports


ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1088

"C:\Program Files\Steam\bin\steamservice.exe" /Install

C:\Program Files\Steam\bin\steamservice.exe

ns707D.tmp

User:

admin

Company:

Valve Corporation

Integrity Level:

HIGH

Description:

Steam Client Service

Exit code:

Version:

04.52.21.91

Modules

Images
c:\program files\steam\bin\steamservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll

1300

"C:\Users\admin\AppData\Local\Temp\SteamSetup.exe"

C:\Users\admin\AppData\Local\Temp\SteamSetup.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Description:

Steam

Exit code:

Version:

2.10.91.91

Modules

Images
c:\users\admin\appdata\local\temp\steamsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll

2516

"C:\Users\admin\AppData\Local\Temp\SteamSetup.exe"

C:\Users\admin\AppData\Local\Temp\SteamSetup.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

Steam

Exit code:

3221226540

Version:

2.10.91.91

Modules

Images
c:\users\admin\appdata\local\temp\steamsetup.exe
c:\systemroot\system32\ntdll.dll

2580

"C:\Program Files\Steam\steam.exe"

C:\Program Files\Steam\steam.exe

explorer.exe

User:

admin

Company:

Valve Corporation

Integrity Level:

MEDIUM

Description:

Steam Client Bootstrapper

Exit code:

4294967294

Version:

04.52.21.91

Modules

Images
c:\program files\steam\steam.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll

3140

"C:\Users\admin\AppData\Local\Temp\nsz3373.tmp\ns707D.tmp" "C:\Program Files\Steam\bin\steamservice.exe" /Install

C:\Users\admin\AppData\Local\Temp\nsz3373.tmp\ns707D.tmp

—

SteamSetup.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\nsz3373.tmp\ns707d.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll

Add for printing

Total events

404

Read events

372

Write events

Delete events

Modification events


(PID) Process:	(1300) SteamSetup.exe	Key:	HKEY_CURRENT_USER\Software\Valve\Steam
Operation:	write	Name:	Language
Value: english
(PID) Process:	(1300) SteamSetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam
Operation:	write	Name:	Language
Value: english
(PID) Process:	(1300) SteamSetup.exe	Key:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	Steam
Value: "C:\Program Files\Steam\steam.exe" -silent
(PID) Process:	(1300) SteamSetup.exe	Key:	HKEY_CURRENT_USER\Software\Valve\Steam
Operation:	write	Name:	SteamInstaller
Value: SteamSetup.exe
(PID) Process:	(1088) steamservice.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Steam Client Service
Operation:	write	Name:	EventMessageFile
Value: C:\Program Files\Steam\bin\steamservice.exe
(PID) Process:	(1088) steamservice.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Steam Client Service
Operation:	write	Name:	TypesSupported
Value: 7
(PID) Process:	(1088) steamservice.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam
Operation:	write	Name:	InstallPath
Value: C:\Program Files\Steam
(PID) Process:	(1088) steamservice.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\steam
Operation:	write	Name:
Value: URL:steam protocol
(PID) Process:	(1088) steamservice.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\steam
Operation:	write	Name:	URL Protocol
Value:
(PID) Process:	(1088) steamservice.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Classes\steam\DefaultIcon
Operation:	write	Name:
Value: steam.exe

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1300	SteamSetup.exe	C:\Program Files\Steam\public\steambootstrapper_brazilian.txt		text
		MD5:0FAD7D2F29C625003FF68E645593F27E	SHA256:E4149F2D2E2FE362241717E161838E6177A1CCC522E1B95746FBD7D05BB0749F
1300	SteamSetup.exe	C:\Users\admin\AppData\Local\Temp\nsz3373.tmp\nsProcess.dll		executable
		MD5:F0438A894F3A7E01A4AAE8D1B5DD0289	SHA256:30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
1300	SteamSetup.exe	C:\Users\admin\AppData\Local\Temp\nsz3373.tmp\nsDialogs.dll		executable
		MD5:0D45588070CF728359055F776AF16EC4	SHA256:067C77D51DF034B4A614F83803140FBF4CD2F8684B88EA8C8ACDF163EDAD085A
1300	SteamSetup.exe	C:\Users\admin\AppData\Local\Temp\nsz3373.tmp\System.dll		executable
		MD5:A4DD044BCD94E9B3370CCF095B31F896	SHA256:2E226715419A5882E2E14278940EE8EF0AA648A3EF7AF5B3DC252674111962BC
1300	SteamSetup.exe	C:\Users\admin\AppData\Local\Temp\nsz3373.tmp\modern-wizard.bmp		image
		MD5:3614A4BE6B610F1DAF6C801574F161FE	SHA256:16E0EDC9F47E6E95A9BCAD15ADBDC46BE774FBCD045DD526FC16FC38FDC8D49B
1300	SteamSetup.exe	C:\Program Files\Steam\Steam.exe		executable
		MD5:565D90CDC73F2CBC03D5C184C70FC524	SHA256:70BDE9E88AA386AA5139CAC0C8A78B5576F1BED9E5F719C4E620D5C0CF7D5CBF
1300	SteamSetup.exe	C:\Program Files\Steam\bin\SteamService.exe		executable
		MD5:3E654318B9C1203BEB7F4AEFB2F6D839	SHA256:2CDB8A21456DF3DBC46C23460BE079BF285B1352BD6B131F572D4CB52BACF252
1300	SteamSetup.exe	C:\Program Files\Steam\public\steambootstrapper_bulgarian.txt		text
		MD5:84ABAF1CA4BF7372ACDC9F89D3B7592D	SHA256:8DD4D81CB374750DE3D3DF6FFD0CC238EC5D1E3946DFEF4B4C8380BDD832D0FD
1300	SteamSetup.exe	C:\Program Files\Steam\public\steambootstrapper_french.txt		text
		MD5:0182A05CF3AA48B0DF12D899EE137EBD	SHA256:46CE11C8ADD1FC89ABE663B42A18E24C11FF8377A2ED2A4C35E835BB696701E1
1300	SteamSetup.exe	C:\Program Files\Steam\public\steambootstrapper_czech.txt		text
		MD5:B02DDD5E3B43E43EE9E51E13968B7A21	SHA256:81A445A3CEB495564829CC7B0280FA993974B33476B85EDCDF87F738CA82705B

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2580	steam.exe	GET	302	162.254.197.97:80	http://client-download.steampowered.com/client/steam_client_win32	DE	—	—	whitelisted
2580	steam.exe	GET	—	2.16.186.64:80	http://media4.steampowered.com/client/tenfoot_misc_all.zip.4c0b5f375e0cf723851ad7c948769632275a4ac2	unknown	—	—	whitelisted
2580	steam.exe	GET	—	2.16.186.64:80	http://media4.steampowered.com/client/tenfoot_dicts_all.zip.2f96d3383504893e85aae7d04c60b3c805c6ca86	unknown	—	—	whitelisted
2580	steam.exe	GET	—	2.16.186.64:80	http://media4.steampowered.com/client/tenfoot_fonts_all.zip.vz.f9f14582a5875c59b57d8d80425f4edd37ebbe25_12075417	unknown	—	—	whitelisted
2580	steam.exe	GET	200	2.16.186.64:80	http://media4.steampowered.com/client/steam_client_win32?1551834664	unknown	text	10.3 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2580	steam.exe	162.254.197.97:80	client-download.steampowered.com	Valve Corporation	DE	unknown
2580	steam.exe	2.16.186.64:80	media4.steampowered.com	Akamai International B.V.	—	whitelisted

DNS requests

Domain	IP	Reputation
client-download.steampowered.com	162.254.197.97 162.254.197.10 162.254.197.98 162.254.197.92 162.254.197.99 162.254.197.12 162.254.197.20 162.254.197.103	whitelisted
media4.steampowered.com	2.16.186.64 2.16.186.59	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

SteamSetup.exe

81448C2E730B50B597BBD5E43007CE6A

4B1B85EC2499A4CE07C89609B256923A4FC479E5

3BC6942FE09F10ED3447BCCDCF4A70ED369366FEF6B2C7F43B541F1A3C5D1C51

24576:QDliBd5TyliR0gWwOvTCU1z3zk51iq449nkU0/1COmcrOqpXzzE2YeshfLKB7:QD8tylwXoTCWi1iq1nkU09lRENhJLKB7

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Loads dropped or rewritten executable

Changes the autorun value in the registry

Application was dropped or rewritten from another process

SUSPICIOUS

Creates files in the program directory

Executable content was dropped or overwritten

Creates a software uninstall entry

Starts application with an unusual extension

Modifies the open verb of a shell class

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings