File name:

SteamSetup.exe

Full analysis: https://app.any.run/tasks/49d95a3b-193f-4ba7-813e-44c535b88a52
Verdict: Malicious activity
Analysis date: May 29, 2024, 07:36:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

1B54B70BEEF8EB240DB31718E8F7EB5D

SHA1:

DA5995070737EC655824C92622333C489EB6BCE4

SHA256:

7D3654531C32D941B8CAE81C4137FC542172BFA9635F169CB392F245A0A12BCB

SSDEEP:

98304:S6RFwVoL8grR2bFl3BZmIsejD4m1DnSM3JeZ7FLoiPApPyDqwsd84+e0lLQbolhV:SAbrIo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SteamSetup.exe (PID: 4072)
      • steamservice.exe (PID: 752)

    • Changes the autorun value in the registry

      • SteamSetup.exe (PID: 4072)

    • Actions looks like stealing of personal data

      • steamservice.exe (PID: 752)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • SteamSetup.exe (PID: 4072)

    • The process creates files with name similar to system file names

      • SteamSetup.exe (PID: 4072)

    • Executable content was dropped or overwritten

      • SteamSetup.exe (PID: 4072)
      • steamservice.exe (PID: 752)

    • Starts application with an unusual extension

      • SteamSetup.exe (PID: 4072)

    • Reads the Internet Settings

      • Steam.exe (PID: 336)

    • Creates a software uninstall entry

      • SteamSetup.exe (PID: 4072)

  • INFO

    • Reads the computer name

      • SteamSetup.exe (PID: 4072)
      • steamservice.exe (PID: 752)
      • Steam.exe (PID: 336)
      • wmpnscfg.exe (PID: 552)

    • Checks supported languages

      • SteamSetup.exe (PID: 4072)
      • ns6055.tmp (PID: 1120)
      • steamservice.exe (PID: 752)
      • wmpnscfg.exe (PID: 552)
      • Steam.exe (PID: 336)

    • Creates files in the program directory

      • SteamSetup.exe (PID: 4072)
      • steamservice.exe (PID: 752)
      • Steam.exe (PID: 336)

    • Create files in a temporary directory

      • SteamSetup.exe (PID: 4072)

    • Reads the machine GUID from the registry

      • SteamSetup.exe (PID: 4072)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 552)
      • Steam.exe (PID: 336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:07:25 00:55:51+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x33b6
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.10.91.91
ProductVersionNumber: 2.10.91.91
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Bulgarian
CharacterSet: Windows, Cyrillic
FileDescription: Steam
FileVersion: 2.10.91.91
LegalCopyright: © Valve Corporation
ProductName: Steam
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start steamsetup.exe ns6055.tmp no specs steamservice.exe steam.exe wmpnscfg.exe no specs steamsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
336"C:\Program Files\Steam\steam.exe" C:\Program Files\Steam\Steam.exe
explorer.exe
User:
admin
Company:
Valve Corporation
Integrity Level:
MEDIUM
Description:
Steam
Exit code:
4294967294
Version:
08.90.88.32
Modules
Images
c:\program files\steam\steam.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
552"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
752"C:\Program Files\Steam\bin\steamservice.exe" /InstallC:\Program Files\Steam\bin\steamservice.exe
ns6055.tmp
User:
admin
Company:
Valve Corporation
Integrity Level:
HIGH
Description:
Steam Client Service
Exit code:
0
Version:
08.90.88.32
Modules
Images
c:\program files\steam\bin\steamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1120"C:\Users\admin\AppData\Local\Temp\nsz353D.tmp\ns6055.tmp" "C:\Program Files\Steam\bin\steamservice.exe" /InstallC:\Users\admin\AppData\Local\Temp\nsz353D.tmp\ns6055.tmp—SteamSetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsz353d.tmp\ns6055.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3960"C:\Users\admin\AppData\Local\Temp\SteamSetup.exe" C:\Users\admin\AppData\Local\Temp\SteamSetup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Steam
Exit code:
3221226540
Version:
2.10.91.91
Modules
Images
c:\users\admin\appdata\local\temp\steamsetup.exe
c:\windows\system32\ntdll.dll
4072"C:\Users\admin\AppData\Local\Temp\SteamSetup.exe" C:\Users\admin\AppData\Local\Temp\SteamSetup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Steam
Exit code:
0
Version:
2.10.91.91
Modules
Images
c:\users\admin\appdata\local\temp\steamsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
2 946
Read events
2 914
Write events
30
Delete events
2

Modification events

(PID) Process:(4072) SteamSetup.exeKey:HKEY_CURRENT_USER\Software\Valve\Steam
Operation:writeName:Language
Value:
schinese
(PID) Process:(4072) SteamSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam
Operation:writeName:Language
Value:
schinese
(PID) Process:(4072) SteamSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Steam
Value:
"C:\Program Files\Steam\steam.exe" -silent
(PID) Process:(4072) SteamSetup.exeKey:HKEY_CURRENT_USER\Software\Valve\Steam
Operation:writeName:SteamInstaller
Value:
SteamSetup.exe
(PID) Process:(752) steamservice.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Valve\SteamService
Operation:writeName:installpath_default
Value:
C:\Program Files\Steam
(PID) Process:(752) steamservice.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam
Operation:writeName:InstallPath
Value:
C:\Program Files\Steam
(PID) Process:(752) steamservice.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\steam
Operation:writeName:URL Protocol
Value:
(PID) Process:(752) steamservice.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\steamlink
Operation:writeName:URL Protocol
Value:
(PID) Process:(752) steamservice.exeKey:HKEY_CLASSES_ROOT\steam
Operation:writeName:URL Protocol
Value:
(PID) Process:(752) steamservice.exeKey:HKEY_CLASSES_ROOT\steamlink
Operation:writeName:URL Protocol
Value:
Executable files
10
Suspicious files
2
Text files
33
Unknown types
2

Dropped files

PID
Process
Filename
Type
4072SteamSetup.exeC:\Users\admin\AppData\Local\Temp\nsz353D.tmp\nsProcess.dllexecutable
MD5:08072DC900CA0626E8C079B2C5BCFCF3
SHA256:BB6CE83DDAAD4F530A66A1048FAC868DFC3B86F5E7B8E240D84D1633E385AEE8
4072SteamSetup.exeC:\Program Files\Steam\public\steambootstrapper_bulgarian.txttext
MD5:4C81277A127E3D65FB5065F518FFE9C2
SHA256:76A6BD74194EFD819D33802DECDFDDAAE893069D7000E44944DDA05022CFA6D9
4072SteamSetup.exeC:\Users\admin\AppData\Local\Temp\nsz353D.tmp\modern-header.bmpimage
MD5:DA3486D12BB4C8AEC16BD9E0D363D23F
SHA256:D93B76D51BD2214FA6E999C1BF70B4AFF5165A6542F9B9B2A92B5672601F4624
4072SteamSetup.exeC:\Program Files\Steam\public\steambootstrapper_czech.txttext
MD5:2158881817B9163BF0FD4724D549AED4
SHA256:650A265DFFDC5DC50200BB82D56F416A3A423EECC08C962CFD1BA2D40A1FF3F7
4072SteamSetup.exeC:\Program Files\Steam\public\steambootstrapper_danish.txttext
MD5:03B664BD98485425C21CDF83BC358703
SHA256:FDF7B42B3B027A12E1B79CB10AB9E6E34C668B04EB9E8A907D8611BA46473115
4072SteamSetup.exeC:\Program Files\Steam\public\steambootstrapper_brazilian.txttext
MD5:0340D1A0BBDB8F3017D2326F4E351E0A
SHA256:0FCD7AE491B467858F2A8745C5ECDD55451399778C2119517EE686D1F264B544
4072SteamSetup.exeC:\Program Files\Steam\public\steambootstrapper_finnish.txttext
MD5:9E62FC923C65BFC3F40AAF6EC4FD1010
SHA256:8FF0F3CBDF28102FF037B9CDA90590E4B66E1E654B90F9AEA2CD5364494D02B7
4072SteamSetup.exeC:\Program Files\Steam\Steam.exeexecutable
MD5:33BCB1C8975A4063A134A72803E0CA16
SHA256:12222B0908EB69581985F7E04AA6240E928FB08AA5A3EC36ACAE3440633C9EB1
4072SteamSetup.exeC:\Program Files\Steam\bin\SteamService.exeexecutable
MD5:BA0EA9249DA4AB8F62432617489AE5A6
SHA256:CE177DC8CF42513FF819C7B8597C7BE290F9E98632A34ECD868DC76003421F0D
4072SteamSetup.exeC:\Program Files\Steam\public\steambootstrapper_german.txttext
MD5:5C026FD6072A7C5CF31C75818CDDEDEC
SHA256:0828572E4FA00C186DBF1D9072A6154D65CB499C6A37E338F3305F77A2FEE382
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
336
Steam.exe
2.16.202.65:443
cdn.steamstatic.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
cdn.steamstatic.com
  • 2.16.202.65
  • 2.16.202.64
unknown

Threats

No threats detected
Process
Message
Steam.exe
src\tier0\threadtools.cpp (3465) : Assertion Failed: Illegal termination of worker thread 'Thread(0x00916B78/0x000000FC/0x'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SteamSetup.exe