Windows Analysis Report
AjeraClient.exe

Overview

General Information

Sample name:	AjeraClient.exe
Analysis ID:	1416062
MD5:	40928e4178bda59e746e16881c5fe666
SHA1:	ee16e166193b73dd2e356c5f7e83371af8c2e457
SHA256:	3cef09741f920edcd4b7f0979ac2598c2ebff77323f614f566eb0e1d07cc4758
Infos:

Detection

Score:	17
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

Classification

Signatures

Source: AjeraClient.exe

Static PE information: certificate valid

Source: AjeraClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.pdb; source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER472.tmp.dmp.4.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: AjeraClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.AjeraClient.exe.287fa3d0000.0.unpack, type: UNPACKEDPE

Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: AjeraClient.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: AjeraClient.exe	String found in binary or memory: http://fa1171/Ajera/SAService.rem
Source: AjeraClient.exe	String found in binary or memory: http://help.deltek.com/learningcentersecurity.aspx?version=8
Source: AjeraClient.exe	String found in binary or memory: http://help.deltek.com/learningcentersecurity.aspxSHelp
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/AccountSetup
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/DashboardUrl
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/EmailCredentials
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/Transmit
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/T
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/TU
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: AjeraClient.exe	String found in binary or memory: http://schemas.datacontract.org/2004/07/FileTaxes.PartnerIntegration.AccountSetup
Source: AjeraClient.exe	String found in binary or memory: http://schemas.datacontract.org/2004/07/FileTaxes.PartnerIntegration.Transmit
Source: AjeraClient.exe	String found in binary or memory: http://timestamp.digicert.com
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/company/contact-us.aspx
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/legal/SoftwareLicenseAjera.aspx/Ajera
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/legal/SoftwareLicenseAjera.aspx?record=
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/solutioncenter7https://www.ajerausers.org/-Crystal
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/support/webinars.aspxghttp://www.axium.com/support/training-sessions.aspx
Source: AjeraClient.exe	String found in binary or memory: http://www.axiumae.com/DataUpload/CustomCrystal/
Source: AjeraClient.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: AjeraClient.exe	String found in binary or memory: http://www.greatland.com/Schemas/GWX/1.0/
Source: AjeraClient.exe	String found in binary or memory: http://www.surveymonkey.com/s/MGDWLLGkAxium
Source: AjeraClient.exe	String found in binary or memory: https://ajera.comEUnable
Source: AjeraClient.exe	String found in binary or memory: https://axium.nelcoportal.com/IntegrationService.svc
Source: AjeraClient.exe	String found in binary or memory: https://axium.nelcoportal.com/IntegrationService.svc?
Source: AjeraClient.exe	String found in binary or memory: https://axiumsdkdev.nelcoportal.com/IntegrationService.svc
Source: AjeraClient.exe	String found in binary or memory: https://axwebservices.axium.com/webservices/ajeraservice.asmx
Source: AjeraClient.exe	String found in binary or memory: https://update.axium.com/SQLEXPR_TOOLKIT.EXE;Downloading
Source: AjeraClient.exe	String found in binary or memory: https://update.axium.com/SqlServer/
Source: AjeraClient.exe	String found in binary or memory: https://update.axium.com/SupportingFiles/9Downloading
Source: AjeraClient.exe	String found in binary or memory: https://www.axium.com/DataUpload/
Source: AjeraClient.exe	String found in binary or memory: https://www.axium.com/DataUpload/ClientInvoiceDesignerInstallResults/cGCHandle
Source: AjeraClient.exe	String found in binary or memory: https://www.axium.com/DataUpload/InstallResults/EUnable
Source: AjeraClient.exe	String found in binary or memory: https://www.billandpay.com/business/authapp.php?appid=

One or more processes crash

Source: C:\Users\user\Desktop\AjeraClient.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4292 -s 724

Tries to load missing DLLs

Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: AjeraClient.exe	Binary or memory string: Ajera.RDLInvoices.VisualStudioReportProjectFiles.AjeraInvoiceFormat.sln/\AjeraInvoiceFormat.suo
Source: AjeraClient.exe	Binary or memory string: AjeraReporting\AjeraInvoiceFormat\AjeraCustomInvoiceFormat.rdl"MAjeraReporting\AjeraInvoiceFormat.sln"/\AjeraInvoiceFormat.sln
Source: AjeraClient.exe	Binary or memory string: /edit "QAjeraReporting\AjeraInvoiceFormat.sln" "
Source: AjeraClient.exe	Binary or memory string: Ajera.RDLInvoices.VisualStudioReportProjectFiles.AjeraInvoiceFormat.sln

Source: classification engine

Classification label: clean17.troj.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\AjeraClient.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4292

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9bb31423-38ff-42ad-b5f8-d577c945b4b1

Jump to behavior

Source: AjeraClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AjeraClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.84%

Source: C:\Users\user\Desktop\AjeraClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT tKey,tStatus,tProject,tActivity,tType,tDate,tUnits,tCostRate,tCostAmount,tBilledUnits,tBilledRate,tBilledAmount,tNotes,tInhouseExpense,tIsImported,tCompany, tGLCostControlEntity = CONVERT(INT, 0) FROM AxTransaction WHERE tKey = 0/ Importing expenses ;Credit Department Description+Credit Department Key)tGLCostControlEntity'sImportExpensePhase-sImportExpenseActivityaSELECT eKey FROM AxEntity WHERE eDescription = '
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT , reIsUsed = CONVERT(Bit,0) FROM AxReportingEntity WHERE reKey <> / ORDER BY reDescriptionoSELECT FROM AxOrganizationalLevel ORDER BY olKey DESC; AND reOrganizationalLevel =
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(*) FROM AxRecurringGLDistribution WHERE glrdEntity = ;UPDATE AxVEC SET vecEntity = ' WHERE vecEntity = S AND vecIsEmployee = 1 AND vecStatus = 1GUPDATE AxVEC SET vecVendorEntity = 3 WHERE vecVendorEntity = O AND vecIsVendor = 1 AND vecStatus = 1mUPDATE AxActivity SET actInHouseExpenseCreditEntity = O WHERE actInHouseExpenseCreditEntity = CUPDATE AxProject SET prjEntity = ' WHERE prjEntity = IUPDATE AxBankAccount SET baEntity = % WHERE baEntity = ]UPDATE AxGLExpenseAllocation SET gleaEntity = ) WHERE gleaEntity = {UPDATE AxRecurringVendorInvoiceDistribution SET vridEntity = ) WHERE vridEntity = eUPDATE AxRecurringGLDistribution SET glrdEntity = ) WHERE glrdEntity = 'DepartmentSetupForm!Department Setup
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(*) FROM AxRecurringGLDistribution WHERE (glrdAccount = ;) OR (glrdCashBasisAccount =
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT resProject FROM AxResource WHERE resActivityType = 1 AND resEmployee = {0}%Refreshing data...iRefresh of cache failed likely corrupted local cache;SELECT CAST(@@DBTS AS BIGINT)
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT pcEmployee, payW2Box, payW2Description, tYtdAmount = SUM(tPayrollAmount) FROM PayCheckPay WHERE payW2Box > 0 AND pcStatus = ; AND prPayDate >= '01/01/

Source: AjeraClient.exe	String found in binary or memory: Add Consultant/Add consultant resourceIrecalculate the cost and fee amounts
Source: AjeraClient.exe	String found in binary or memory: Rows Row-Add column to the left/Add column to the right
Source: AjeraClient.exe	String found in binary or memory: Rows Row-Add column to the left/Add column to the right
Source: AjeraClient.exe	String found in binary or memory: First Employee#Beginning install-Stopping Ajera Service
Source: AjeraClient.exe	String found in binary or memory: ===========/Installation successful
Source: AjeraClient.exe	String found in binary or memory: Update from ahttps://www.axium.com/DataUpload/InstallResults/EUnable to log installation results
Source: AjeraClient.exe	String found in binary or memory: Start/stop time
Source: AjeraClient.exe	String found in binary or memory: Start/stop time
Source: AjeraClient.exe	String found in binary or memory: pctYTDSubjectTo-AddedMedicareWagesTips7TaxOnAddedMedicareWagesTips7TotalSocialSecurityMedTaxes#SickPayAdjustment5FractionsOfCentsAdjustment=TotalDepositsOverpaymentForQtr

Source: unknown	Process created: C:\Users\user\Desktop\AjeraClient.exe "C:\Users\user\Desktop\AjeraClient.exe"
Source: C:\Users\user\Desktop\AjeraClient.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4292 -s 724

Source: C:\Users\user\Desktop\AjeraClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AjeraClient.exe

Static PE information: certificate valid

Source: AjeraClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AjeraClient.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AjeraClient.exe

Static file information: File size 8345424 > 1048576

Source: AjeraClient.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x7ed000

Source: AjeraClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.pdb; source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER472.tmp.dmp.4.dr

Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\AjeraClient.exe	Memory allocated: 287FAEE0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Memory allocated: 287FCAB0000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\AjeraClient.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\AjeraClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\AjeraClient.exe

Queries volume information: C:\Users\user\Desktop\AjeraClient.exe VolumeInformation

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AjeraClient.exe_6563b875ae84bf1f0c3457b8eec59433e179d_2fc16863_449eee62-fe53-4c3a-9d43-053e873c7c56\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	E015C208AEDA5ED6E846D2C0C089211E	6052E55CDA82DD2E81B6EEA63BA7FACC68FC01E6	D75FD7ED857816D40F533C3A6D4C423A5287B2EE96717752FA82FEDECF205A92
C:\ProgramData\Microsoft\Windows\WER\Temp\WER472.tmp.dmp	Mini DuMP crash report, 16 streams, Tue Mar 26 18:56:15 2024, 0x1205a4 type	47ED4C8C6D316AEF195A9EAD4DBA4144	491A1711DEE1AA40E1F0DAE581251051EFE0E8FD	C9EB1AB90111A3C81459427160C65F116F227197E898B1654744587DE7F0AFF7
C:\ProgramData\Microsoft\Windows\WER\Temp\WER51F.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	DB635B77E2A47C7625A5C1A0FDC1933A	48502C4E93853E4BB93D6DC434C8F93B582EE564	F51EF108C7734D9182B6319C8D0C8322C003DD27FF3F8BE8020E984A670B0E7F
C:\ProgramData\Microsoft\Windows\WER\Temp\WER54F.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	F62EF7864DC336EA1335629C87CD65B8	83ED6412407BB1FE2C96BA2C0AA0ACD847F1B4CB	84880181B8AA128235CC4AA23924B41B693FFCD432E6A390777AA39FAC8F10CA
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	19BF1C05C1F05E70857E52BC5A42E619	4F068F48B887099FEF30A98CFCAA7883C4886FA5	3CD0803877BDEBE902E8755B66DC828FF8E2A28812CE8B6FD72DBEA0421E1181

Source: AjeraClient.exe

Static PE information: certificate valid

Source: AjeraClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.pdb; source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER472.tmp.dmp.4.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: AjeraClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.AjeraClient.exe.287fa3d0000.0.unpack, type: UNPACKEDPE

Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: AjeraClient.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AjeraClient.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: AjeraClient.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: AjeraClient.exe	String found in binary or memory: http://fa1171/Ajera/SAService.rem
Source: AjeraClient.exe	String found in binary or memory: http://help.deltek.com/learningcentersecurity.aspx?version=8
Source: AjeraClient.exe	String found in binary or memory: http://help.deltek.com/learningcentersecurity.aspxSHelp
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/AccountSetup
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/DashboardUrl
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/EmailCredentials
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/IntegrationService/Transmit
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/T
Source: AjeraClient.exe	String found in binary or memory: http://nelcosolutions.com/TU
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: AjeraClient.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: AjeraClient.exe	String found in binary or memory: http://schemas.datacontract.org/2004/07/FileTaxes.PartnerIntegration.AccountSetup
Source: AjeraClient.exe	String found in binary or memory: http://schemas.datacontract.org/2004/07/FileTaxes.PartnerIntegration.Transmit
Source: AjeraClient.exe	String found in binary or memory: http://timestamp.digicert.com
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/company/contact-us.aspx
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/legal/SoftwareLicenseAjera.aspx/Ajera
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/legal/SoftwareLicenseAjera.aspx?record=
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/solutioncenter7https://www.ajerausers.org/-Crystal
Source: AjeraClient.exe	String found in binary or memory: http://www.axium.com/support/webinars.aspxghttp://www.axium.com/support/training-sessions.aspx
Source: AjeraClient.exe	String found in binary or memory: http://www.axiumae.com/DataUpload/CustomCrystal/
Source: AjeraClient.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: AjeraClient.exe	String found in binary or memory: http://www.greatland.com/Schemas/GWX/1.0/
Source: AjeraClient.exe	String found in binary or memory: http://www.surveymonkey.com/s/MGDWLLGkAxium
Source: AjeraClient.exe	String found in binary or memory: https://ajera.comEUnable
Source: AjeraClient.exe	String found in binary or memory: https://axium.nelcoportal.com/IntegrationService.svc
Source: AjeraClient.exe	String found in binary or memory: https://axium.nelcoportal.com/IntegrationService.svc?
Source: AjeraClient.exe	String found in binary or memory: https://axiumsdkdev.nelcoportal.com/IntegrationService.svc
Source: AjeraClient.exe	String found in binary or memory: https://axwebservices.axium.com/webservices/ajeraservice.asmx
Source: AjeraClient.exe	String found in binary or memory: https://update.axium.com/SQLEXPR_TOOLKIT.EXE;Downloading
Source: AjeraClient.exe	String found in binary or memory: https://update.axium.com/SqlServer/
Source: AjeraClient.exe	String found in binary or memory: https://update.axium.com/SupportingFiles/9Downloading
Source: AjeraClient.exe	String found in binary or memory: https://www.axium.com/DataUpload/
Source: AjeraClient.exe	String found in binary or memory: https://www.axium.com/DataUpload/ClientInvoiceDesignerInstallResults/cGCHandle
Source: AjeraClient.exe	String found in binary or memory: https://www.axium.com/DataUpload/InstallResults/EUnable
Source: AjeraClient.exe	String found in binary or memory: https://www.billandpay.com/business/authapp.php?appid=

One or more processes crash

Source: C:\Users\user\Desktop\AjeraClient.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4292 -s 724

Tries to load missing DLLs

Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: AjeraClient.exe	Binary or memory string: Ajera.RDLInvoices.VisualStudioReportProjectFiles.AjeraInvoiceFormat.sln/\AjeraInvoiceFormat.suo
Source: AjeraClient.exe	Binary or memory string: AjeraReporting\AjeraInvoiceFormat\AjeraCustomInvoiceFormat.rdl"MAjeraReporting\AjeraInvoiceFormat.sln"/\AjeraInvoiceFormat.sln
Source: AjeraClient.exe	Binary or memory string: /edit "QAjeraReporting\AjeraInvoiceFormat.sln" "
Source: AjeraClient.exe	Binary or memory string: Ajera.RDLInvoices.VisualStudioReportProjectFiles.AjeraInvoiceFormat.sln

Source: classification engine

Classification label: clean17.troj.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\AjeraClient.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4292

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9bb31423-38ff-42ad-b5f8-d577c945b4b1

Jump to behavior

Source: AjeraClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: AjeraClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.84%

Source: C:\Users\user\Desktop\AjeraClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT tKey,tStatus,tProject,tActivity,tType,tDate,tUnits,tCostRate,tCostAmount,tBilledUnits,tBilledRate,tBilledAmount,tNotes,tInhouseExpense,tIsImported,tCompany, tGLCostControlEntity = CONVERT(INT, 0) FROM AxTransaction WHERE tKey = 0/ Importing expenses ;Credit Department Description+Credit Department Key)tGLCostControlEntity'sImportExpensePhase-sImportExpenseActivityaSELECT eKey FROM AxEntity WHERE eDescription = '
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT , reIsUsed = CONVERT(Bit,0) FROM AxReportingEntity WHERE reKey <> / ORDER BY reDescriptionoSELECT FROM AxOrganizationalLevel ORDER BY olKey DESC; AND reOrganizationalLevel =
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(*) FROM AxRecurringGLDistribution WHERE glrdEntity = ;UPDATE AxVEC SET vecEntity = ' WHERE vecEntity = S AND vecIsEmployee = 1 AND vecStatus = 1GUPDATE AxVEC SET vecVendorEntity = 3 WHERE vecVendorEntity = O AND vecIsVendor = 1 AND vecStatus = 1mUPDATE AxActivity SET actInHouseExpenseCreditEntity = O WHERE actInHouseExpenseCreditEntity = CUPDATE AxProject SET prjEntity = ' WHERE prjEntity = IUPDATE AxBankAccount SET baEntity = % WHERE baEntity = ]UPDATE AxGLExpenseAllocation SET gleaEntity = ) WHERE gleaEntity = {UPDATE AxRecurringVendorInvoiceDistribution SET vridEntity = ) WHERE vridEntity = eUPDATE AxRecurringGLDistribution SET glrdEntity = ) WHERE glrdEntity = 'DepartmentSetupForm!Department Setup
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT COUNT(*) FROM AxRecurringGLDistribution WHERE (glrdAccount = ;) OR (glrdCashBasisAccount =
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT resProject FROM AxResource WHERE resActivityType = 1 AND resEmployee = {0}%Refreshing data...iRefresh of cache failed likely corrupted local cache;SELECT CAST(@@DBTS AS BIGINT)
Source: AjeraClient.exe, 00000000.00000000.2015086331.00000287FA3D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT pcEmployee, payW2Box, payW2Description, tYtdAmount = SUM(tPayrollAmount) FROM PayCheckPay WHERE payW2Box > 0 AND pcStatus = ; AND prPayDate >= '01/01/

Source: AjeraClient.exe	String found in binary or memory: Add Consultant/Add consultant resourceIrecalculate the cost and fee amounts
Source: AjeraClient.exe	String found in binary or memory: Rows Row-Add column to the left/Add column to the right
Source: AjeraClient.exe	String found in binary or memory: Rows Row-Add column to the left/Add column to the right
Source: AjeraClient.exe	String found in binary or memory: First Employee#Beginning install-Stopping Ajera Service
Source: AjeraClient.exe	String found in binary or memory: ===========/Installation successful
Source: AjeraClient.exe	String found in binary or memory: Update from ahttps://www.axium.com/DataUpload/InstallResults/EUnable to log installation results
Source: AjeraClient.exe	String found in binary or memory: Start/stop time
Source: AjeraClient.exe	String found in binary or memory: Start/stop time
Source: AjeraClient.exe	String found in binary or memory: pctYTDSubjectTo-AddedMedicareWagesTips7TaxOnAddedMedicareWagesTips7TotalSocialSecurityMedTaxes#SickPayAdjustment5FractionsOfCentsAdjustment=TotalDepositsOverpaymentForQtr

Source: unknown	Process created: C:\Users\user\Desktop\AjeraClient.exe "C:\Users\user\Desktop\AjeraClient.exe"
Source: C:\Users\user\Desktop\AjeraClient.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4292 -s 724

Source: C:\Users\user\Desktop\AjeraClient.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AjeraClient.exe

Static PE information: certificate valid

Source: AjeraClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: AjeraClient.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: AjeraClient.exe

Static file information: File size 8345424 > 1048576

Source: AjeraClient.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x7ed000

Source: AjeraClient.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Windows.Forms.pdb; source: WER472.tmp.dmp.4.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.ni.pdb source: WER472.tmp.dmp.4.dr
Source:	Binary string: System.pdb source: WER472.tmp.dmp.4.dr

Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\AjeraClient.exe	Memory allocated: 287FAEE0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Memory allocated: 287FCAB0000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\AjeraClient.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\AjeraClient.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\AjeraClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\AjeraClient.exe

Queries volume information: C:\Users\user\Desktop\AjeraClient.exe VolumeInformation

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

ID:	1416062
Product:	CloudBasic
Start time:	19:55:27
Start date:	26.03.2024
Sample:	AjeraClient.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	40928e4178bda59e746e16881c5fe666
SHA1:	ee16e166193b73dd2e356c5f7e83371af8c2e457
SHA256:	3cef09741f920edcd4b7f0979ac2598c2ebff77323f614f566eb0e1d07cc4758
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.84%

Windows Analysis Report
AjeraClient.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report AjeraClient.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
AjeraClient.exe