Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    136s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    04/12/2024, 19:11

General

  • Target

    c3fd36103f617324d4d2fa833989096c_JaffaCakes118.apk

  • Size

    4.9MB

  • MD5

    c3fd36103f617324d4d2fa833989096c

  • SHA1

    f12b9d0c224e0130e33af012b883c6405bb32503

  • SHA256

    0cc18aa0a58ac84d39ea0d681caa378f0c85e39fff230b85239fec5960068870

  • SHA512

    8d4b97982f18c67d90f074c518ea496ce2ba3add85529903108acfe266de02c9aa4c93b93e1fbba99a08658a78fb788450760a2d9c7983e65ed9a9eb195ea00e

  • SSDEEP

    98304:U7pojb8O89LBkmUVyt1CXzTAy6ndf8GDLPGNw9PSqflLO0iX:U7pTO89K/VOCXfm98GPuq5PS0iX

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Acquires the wake lock 2 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.contextlogic.wish.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4965
  • com.contextlogic.wish.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5010

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.contextlogic.wish.hack/databases/OneSignal.db

    Filesize

    52KB

    MD5

    5f95caa096ebd3fe93432163e3fd2d34

    SHA1

    48c9bba88699f9fbf625d27b189ab4395662ccc2

    SHA256

    c17b0ff6f351266dfc375282c9ee02b8263348390207cec71835d7e0956419e3

    SHA512

    e828b3db8d88c761426eaeb76cf836fb92a1a5063a10ae3ec75425057f7e638a17f698b4fbb8202c17ac767abc60482e7d2f702e0d340dcfa21f0a4c6380e0a2

  • /data/data/com.contextlogic.wish.hack/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    44880dca6c5598aab54f631a56d957dd

    SHA1

    8f1dc49b6f66c7d2547cd791d165095aaf3e9d6a

    SHA256

    acba756bdb821f03d5a5a24420719eca9e5f95b87f63e7444ec30add94b9f454

    SHA512

    b387fd87a26c933718123d47980b6d8804151e3d676301800ef89b4eac27327de6f9140326bc4dcc8f9a2b763e628164310855b8cb98032e0d30063a5a869f5b

  • /data/data/com.contextlogic.wish.hack/databases/OneSignal.db-journal

    Filesize

    512B

    MD5

    6e7d3f28c7e825451acce4645ce74b3e

    SHA1

    8194b7e049a9757da9b6231c7535e9c5253bef1a

    SHA256

    84bbb87b0015f6dcade4fd5e0c7b84bbd58230130254b788ad7d307c17a6756a

    SHA512

    15a6c78c12fa116cb89b58c13f6155e94783212e86cac2b6050976a5697bbd1f8724ce310e654233b89b5975d14283db6724e9dd63c230789cc7486f489ddb8f

  • /data/data/com.contextlogic.wish.hack/databases/OneSignal.db-journal

    Filesize

    8KB

    MD5

    43466157c9bd83d7e701205d02033053

    SHA1

    1c82436bbae2dce32b35dfc20bf2c1abb91de730

    SHA256

    22a607c0eeffec794d00e3322ba79957402501da35edf4e4aa072c8f272af7a0

    SHA512

    940c56b74d45744c7be2bd7cd8f8e1cdf794f13b9db8a1cd2c1a8571b208fabb1728d09b1fe7052bcf8056458f6696c51bccb95387acbc92fd86478faf0d4634

  • /data/data/com.contextlogic.wish.hack/files/Mint-lastsavedfile

    Filesize

    36KB

    MD5

    5801e77d7e405601781a3e69fa4a2ea1

    SHA1

    f255c700c626f2d183ef8d5fc998143a0b48409d

    SHA256

    ac30c1347adc80594e456d3504b4473742a217c2d5aa957861d5c08b1616b697

    SHA512

    11901d4288d30699ec24d869012a4972c052dc159ec3a3b4b7953888b73b0a524dfb4406332ed3404acaf29eedca4e586d53b1975f0784e905d5c844b97db66f

  • /data/data/com.contextlogic.wish.hack/files/Mint-lastsavedfile

    Filesize

    12KB

    MD5

    df784fb9bcc7cd6adcbad19965424db2

    SHA1

    a51999045b273cca64a2dc7888c1525b522261e0

    SHA256

    63f8a18a0909cdd88a3232d318598f6bb0a88e42adc3c205e491116452713055

    SHA512

    e9a26a63d47cdec6edbc26a19f0388aa46d78a246f220b612b2922e9d884d2e9c6d43c36f353edbf964a165b35e2ff21b2aef497404430ffcd4b84d73642b93f

  • /data/data/com.contextlogic.wish.hack/files/MintSavedData-1-1733339525752.json

    Filesize

    12KB

    MD5

    6d146e26682f51520f58d9d985e47fb2

    SHA1

    36ae14db89ec22efd9e9f3a487f69800242f8d56

    SHA256

    4cc043439a64a166de9725c4e0a552a7ca69154116ccc268fe6302e3f621e1bf

    SHA512

    a5b762de53372465bd997b4244d26bf198a8db8a36d2001e225735f830f1ed0e77d3880fc803182f2436c30d2c3f4b308b93c566a40af62927344e454c5e1bc8

  • /data/data/com.contextlogic.wish.hack/files/MintSavedData-1-1733339525752.json

    Filesize

    12KB

    MD5

    1a25d3459c76ec1293aa0c407cb9f8a1

    SHA1

    622033f23dfab3a42c429d3d7d4cee49404d5ccf

    SHA256

    72c6c441841162d97b93e19430382dc1828d9193c6f7da700357fae76b375474

    SHA512

    48ed992c321ed561000e51403cfe6e9e3394f92513aca5f44b250126226d7537696ffe8628e6a50c960a09b7d6e7162f70cfb60526aad4e719b93d5b057c058c

  • /data/data/com.contextlogic.wish.hack/files/crashCounter

    Filesize

    226B

    MD5

    7922aa02d4c1255afe9b8ad804323dea

    SHA1

    dda11bb772c4efe1d54c20b804c831b957ae5eab

    SHA256

    f7e1e2ed87b0c85048eadf92ccf149927b026ab4439568ea121d3f0260fcd297

    SHA512

    7667c6cd512ec82e9f8ac116b2661552acc6685e7f3c1d0d551bbcf2b6779c078d1526ef311f6960aaa0419c776215ca356cedc4c829f5482a7964dfb32efd9c

  • /data/data/com.contextlogic.wish.hack/files/lastCrashID

    Filesize

    8KB

    MD5

    247f96be83e44eaa41e638bc5ee28f91

    SHA1

    9a8f23cbb245a0723ff18fc2a24a457acd7dbd92

    SHA256

    0b669e0569f9907a6e815c2b874eb80bd80ca9cc63b1337ae91ce639e0a5a12b

    SHA512

    e7d444f967fccd4a2a998a19f557da8ad5f81bab6ea9a444a6f2e7ece440c900fcc143c24e70e98f41ee2ebe0ef3ec6dea4564dfd486a373560fc3d4a78fd4a9

  • /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb

    Filesize

    4KB

    MD5

    f2b4b0190b9f384ca885f0c8c9b14700

    SHA1

    934ff2646757b5b6e7f20f6a0aa76c7f995d9361

    SHA256

    0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

    SHA512

    ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

  • /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-journal

    Filesize

    12KB

    MD5

    fb5cf6e7d9fde19e770b6274f609b47b

    SHA1

    3d42de7dc524380c9abcc168cb105619630ccff1

    SHA256

    e9ffa8928517ae44ac806714bc405a3ecd7de346debc4d1b8c848db627350d27

    SHA512

    3444fc35e2f546dab5e05a4a2fa69cf630794a1f13fc85832dc58f025f9362ce90533c102d854a90b74747713d88b59bbf850f06aadd266196ceaac3e5a9cfb6

  • /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-shm

    Filesize

    80KB

    MD5

    388c86511eed8f1a4169f83b10b81f02

    SHA1

    46dca59617a04c8909332444f845961219a8be77

    SHA256

    4dbea7766871d76828fb5091044fb1d00387ccf85edf652b4da97c369d2f8d94

    SHA512

    7cf7c5d7271e1510110c63566bcc3ba8fd8f8f65ed21e3f48e685e0f0e014126efa36ed52010663e550c7febdd029c515f95f5b5e08555b19d5f696222441309

  • /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal

    Filesize

    16KB

    MD5

    57af1ce7f88a2844eeff6f5cfc4065a2

    SHA1

    c147dcfbc4d1e5a92e179601d6b757ea7d273f51

    SHA256

    19718a62ae4fce453685535bc0f1b2a05a6c78b30b6de1ab4e8ee922d55e5c3c

    SHA512

    db4824db6471adcca6d165f21ad8d7e6601e36491c16e49eac2faf8fa01906fd4243d5cc01f6535d0d381dcdd09dee3a0652fc0913f38bdfead69248058bfb55

  • /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal

    Filesize

    108KB

    MD5

    2676002406a380c4053ea31698a7511e

    SHA1

    b10abc30cb208ab13bb4c6c1b56db0466bb2d682

    SHA256

    372376fa9790bf957c581dd6090365fabfb5ad6b898629ed355b42545a909836

    SHA512

    a7bc9c1a4319056d11b71bf9913773bcbf512ee42a8970a276c1691a90e7fe5633132c622b8290d0c87aae1b5ba0243ba795abe97200f42520777aeb4f8cb180

  • /data/data/com.contextlogic.wish.hack/no_backup/androidx.work.workdb-wal

    Filesize

    265KB

    MD5

    039e759ffe8f1a3f840366242ccafc01

    SHA1

    9a405f702f315557efc5827d66ec01141f63f016

    SHA256

    c42256687d0ee8d65c9f22ecb30d4bb165890ff93968e3e05699014ae0e8e288

    SHA512

    90c9105df359152902f6e31ce86a97634cc440aae6235a74934b8fd1b019dcfa62f9f242c78321d9b094877145f8959f4382d7ccaa39bb5eb22578089946750f

  • /data/data/com.contextlogic.wish.hack/no_backup/com.google.InstanceId.properties

    Filesize

    116KB

    MD5

    efa67f1c66dfd77da042d87adf2efe17

    SHA1

    dc3e70de6b858e6299f0720d48ab45c98f7099ac

    SHA256

    02747eec1156fcb461d5bab12cede728fa5000928e64014868d5f464883195ee

    SHA512

    b1f0f1d1268a4a967bb6aab6fa42eb9f3bd6fd80f3b98323e943e0864a403f77b29b660e6f192656d666eada405a833ac408d4c941b85562aee54a4118821f6e

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal

    Filesize

    512B

    MD5

    dfc66ac8ad5ca09e578a9a9404b5a7fb

    SHA1

    703be4c0391d68800803caa3983c68515d38b30f

    SHA256

    4b86c5473aa0c3f8a4cadd72acf7dd5563eab1180e730f0d3dd1db2c92779e02

    SHA512

    c697e10ae5b942fc4d8d2dee3a2678e34352322bf07e551f3b82c13d8bb6ae943a9e5e48d6208c6613f5abb4a0714d9083618c5c5db8f481455aaab978864b60

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal

    Filesize

    8KB

    MD5

    ca5e7ed306824f97f054649ef1c80bae

    SHA1

    e0da89865516a793f5e8edd619f5a83a2ef78ebe

    SHA256

    6d48bcdd68374a36b53cbc4fbb586218d3dc0b7f698fdc5a305f5b64fadbdb39

    SHA512

    ef1a871c47d926ccd66e75f9b348b26ede2d5f87a777b3598aef0f8d130a46342737fe2b41dbb1d10cd471214b695d4581a9e7ea1c23f7469c413130853bb727

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal

    Filesize

    12KB

    MD5

    658ac606d92b919d279d6a047ce0e0f6

    SHA1

    fad7d0b0fff528138b1fc5d6ff18a6df48ed49f9

    SHA256

    568b8dc73b14ce5cc650e36f4ebacd01f2f9c1f3922adc511956440b8d09ac5e

    SHA512

    f2ea8cec2b2f651f16af3d089b73777b58b8405c30553a4c1cdcd3000844c32a9128a31a0b201af4755e93803ef27dee4b36edf1d4a2294a1b420d996ae31d1c

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack-journal

    Filesize

    56KB

    MD5

    b42cbfcd75711fb7be13dc7f55123f4a

    SHA1

    0cb5f993245c42b2c5da245377cdf3b142eb5dcd

    SHA256

    0b6e9531fe9e686d69cbedef80324c7464264a07f951c2de6f7cf201c12268b6

    SHA512

    fb3edca9c74627a4e55309f4fe8b82e93567921b24c9fa055a861f487db22a68bdb2dda0318b7875a8610bf9f7a458c6ad3171377c188a156e8e6775b155c916

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    512B

    MD5

    591f4ad4cf44fbe2256ecc759be4b66f

    SHA1

    f9df97694781dac23d229b4df74dc032ced71231

    SHA256

    a282084aefcc1200427466222137aea74238b082fafcf9eef3a1a60b32f009f1

    SHA512

    1d2accdbdaf3e32b0705c1b3cf0ba7a78cbee78bcfacba283bdff512f9767c15d9364b0597555e00b10195b76b856f353133484ffeabe115e77b30c5c8a6930e

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    8KB

    MD5

    c594d15068e55cedaac9a6c853ff56d5

    SHA1

    0793dc9f537a79dee0e686ebc235952a47e81f00

    SHA256

    80c5a1bd5d2b4b33ec8787ab197f7cf154a7176ef872513cbe8a87ff72b05a54

    SHA512

    2cbd486ca454ef6480551c2b00efbb9e58a0065f9ab4d907f66c2c25adceb1e81deb3a2b568f471b00c20d1f45fb7a3703e88e7f0d5daa7edec2d440eac99731

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    9a0dfa291ef5fb807bb765edab74bd95

    SHA1

    53ecb7fbc5fbf6d8b28ca8a0dd1a1ea855dd567f

    SHA256

    40b99911cd5feeebe03a9f9f16d98fb410c7f6e3fba9606d84f8a227743cff54

    SHA512

    75e6ea5fdc7a0b153ae27d38e9ab062153e870c05e79577d2018af9628bbdbfe07923c30bf19a18456da809859afcafae76c12fdc45311a59e4ff5d405dc65db

  • /data/data/com.contextlogic.wish.hack/no_backup/db_metrica_com.contextlogic.wish.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

    Filesize

    12KB

    MD5

    2b33eca1bb6724e420e392346e49be26

    SHA1

    6ae83ccd09c55fea5668d0a6307b45c3b9bf3c34

    SHA256

    b486e8b80509c44d76b5f5210c2b34f4d7b5c01374f8d196265ebd3f53edfe6d

    SHA512

    693fa7f4e5d997b23a0326e244af181521148d239c63e3a1038557d4c260fb96173d2485b8458ad3bebe7a149d43f20b7a78bcd8a97ba670e7b10f4d41a01fc9

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    c04f0bbad72f6971f5e983291e134360

    SHA1

    509f391f22de85b204799dbaa75b79daa6ae23e0

    SHA256

    219dc259e365b154083f15a9726f3c742e4008231bfcbe65e21840a5ab1bd9cb

    SHA512

    eec894ac1fa2ebefa6e7356c0899b3c7d62bbb4daf1a0314290888021cefee4211596b3b8394a79dc7160ac2c3e631e385f695693523d48736ca2f910908bbb8

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    b8761fc0184b91a57d0b013c39bd63c3

    SHA1

    2cf2bc585531012ed1888e3cf60a10f46a5651db

    SHA256

    ea3ab3eb5f71ad7a901500ebac256bdb6bc0fad0f49afe35d34d01130e4e3707

    SHA512

    2280a59332dfdc8e4c6068adc5ea42b7fd4a12a5bbc630d152d103db98bd9f9892d7dbb9eb057cb03dbdbcaa870e858e30d497c4d6b43664781827c37fe8e570

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    a0a548793a510f9caed081689f935eeb

    SHA1

    2d1aad0213b2b86bfe52dd2485741fb00eb02f3a

    SHA256

    4564ec31a51694e8349f462d5ada137b3f37b7c42515a7fe34ea8ef33b5063c5

    SHA512

    624204c5e505d3f2822a9761109babe81079ce8552551f23b7315baa171ef7881e5b5c4eab607a53b9bf080be6cb3100ff8cedf4cc86fa6218cd18301fcdc367

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db

    Filesize

    20KB

    MD5

    7f5c571a0d6f3c0a42d65e417669a1d8

    SHA1

    89e91be53887e595f21395763b0041a4bf27cac0

    SHA256

    d192ba7b94a98afbd2d3628ea95707485d33908fd133e554e82efdb5e09d9a12

    SHA512

    468c20e6916bbb25a7f61bcbe1670175a4ec9f4b3f3d900987a1195c108aa21859620645f815adab0126a656ce107661e5295d1196789bf25b56b269fdd590da

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    437281f7cc171a0d6201974aa960ee93

    SHA1

    ba64a2a4b12fe4a97670b8317d23049d2b7efb36

    SHA256

    ea713e80cc902d7062f86c08b1f0078c934d80c8141e4be62f77b3e292758d9d

    SHA512

    e68f570cda94528db72babe15b17537fa078c935dc191409d1da36fd6c356eacd786a86941014e5b26e41ca27f371814d5dd65d377b4161f63a95f80940c071f

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    512B

    MD5

    7cbb9928fe1e71d0da3e3a3c0e681f02

    SHA1

    d73dc2eb9547ebddcea8c9e8d41cc89fa57bba2f

    SHA256

    5bcec88ee69b2d25dc9d21be07caaf06264680c0a52caa183eb677a3724b14b5

    SHA512

    deef0fb4163bbcfc379e33aa51774b995a5ebe9b4289692c29bd32abb945866859089c8dcbcb60aac759d3ccdeec14addf1c5467c41fa4a2504f4409ae47fdf9

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    12KB

    MD5

    bd019966ff78be7936352e9c209a9cbb

    SHA1

    c20d0cb4cd106e098e05753736ccb09ea4574aa1

    SHA256

    f1e2f754aac874c7183b8017834308088e4d492a60dac60cec2461d20b8a6430

    SHA512

    6eac273f29c2f3e72bc9a00078bcda2646715eeed1169630b66b5d600c021760529ec8a917a53e9aa10e78d1a135f6b227e33a9b6b96059834613d87dadcfa42

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    20KB

    MD5

    acd897379cfdb402ae82d4ee4fa5caea

    SHA1

    22904c0029917b5a1040c034fabdc219ef7a69b4

    SHA256

    891faee0baf2647ec8279d811caed90c4d51b4345fd803c4704367fd43adb11e

    SHA512

    5145c80fd454e42080ec1e8a47fcafa95ca2908d0fcc3dc8bb6154bd2ab1d7f819e3f1fe3fc8c5eba3112ec278a1688e54f0ed84c967a294f18a6c69ea8f3e29

  • /data/data/com.contextlogic.wish.hack/no_backup/metrica_client_data.db-journal

    Filesize

    44KB

    MD5

    ff1b2f6a2087a85c633167c296fd9765

    SHA1

    dc45c1e79aef869cf406a45a4f23f9ca5007ec44

    SHA256

    ebbb01958a5c02ad5fda95c6cbd351c4efec8382f64e3c2d9635c090a5baaa0f

    SHA512

    4d1c31ae67b2c00a37af8ebd48a40d89b5f1d0cfba2d2d3f1ae1924b6042585ea79966e8b06a1a2948c2cc3b39ba05a2591e5e05c546e4f4c317297f1ec1e410