Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
2b0b01c687fd76cbf8788a1df811a7d8_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2b0b01c687fd76cbf8788a1df811a7d8_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2b0b01c687fd76cbf8788a1df811a7d8_JaffaCakes118.html
-
Size
230KB
-
MD5
2b0b01c687fd76cbf8788a1df811a7d8
-
SHA1
b98072337195c29e9bdfbde793ef4560f355d9de
-
SHA256
0af753277f0d72f5b2bfe1f05ae8df10ff16ef6fc16df832a9b28c986f1b47d0
-
SHA512
ba460cbe26d98adf2f24406172f4b157c066741fba2c58c865bcf67be9838307ec7e86cea87629baacadd432d4dd98662de3b6dbd1e0b0b67461f3e0df9d0b52
-
SSDEEP
1536:dfjo7ZkRJT8IeZJwSUrp/95ejBp2O2iK7ZSywAXseZe3pbMF4RlpThXEUnix:Jpv3uFiiaF4RlpThXEUn+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3EB2C91-0E28-11EF-88D8-5E50367223A7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00cd0a635a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421437186" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000634c5ceebd83fa8e5b2667b1a8648ce7e8d8fc69d96b513b1771d60b8774a593000000000e8000000002000020000000d44bd9e401992812e7ef4b9ed417d87e760a942080a34b6124f79debae61852a20000000f04bc8e07de1c94e6f0a0d0040c47c6a8ac98e2f435c7ac81c597ece8c210ad040000000884467ef003a5e070040df06cfd677824f5b5e15ef1962893bee45e3fe5626a3418e3f39b247907ba574c41c0b2625f9228010599ea577dcf553c1da6ca1f9b5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000036251e28f2c10699c177f5ee04943ebae82e530636db97ac9e1690eef6ae3d69000000000e8000000002000020000000a871ebb6cff5cf058697c18d4b01f27123c05b61c14ba89f2228b60c07aadd2990000000842a88dd0712bc7112d3a9ebb54aa7f5629701b4fc159b9a2b2f11d137b6c3974c897c9eed62ca94ad8714ffcf27204f2afc17dbbaeabdf3e5b14b372f2a721c52481ca5c5e43e91dabe8e7dc17c4c3bac4fb8f0b7b30779fdf6611751ca3b8420badac06a68514c6f81fac8ba5e077697b2263a3c5d4af9e915e9b2042a49202942d1b1e338ce0a7d0b745e7a130f5f40000000df49c82394639a4389d4159463e170ceedd298c668fc656da57f0ee99b22ce48c485f13c008456c3c7b364fa4504837099625bf0550ba72399f52d16a25d30cf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1200 iexplore.exe 1200 iexplore.exe 2572 IEXPLORE.EXE 2572 IEXPLORE.EXE 2572 IEXPLORE.EXE 2572 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1200 wrote to memory of 2572 1200 iexplore.exe 28 PID 1200 wrote to memory of 2572 1200 iexplore.exe 28 PID 1200 wrote to memory of 2572 1200 iexplore.exe 28 PID 1200 wrote to memory of 2572 1200 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b0b01c687fd76cbf8788a1df811a7d8_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5207ea2f7471fdd4430892f0a94e37ee4
SHA162e94025927d37d9cf57543609453ea2355c79a9
SHA256936fb35e947c6bd299d88e08b2ae16076d183298b49b0c5c950bcd296bbf57f2
SHA512f2b2d694cffb183d439249eedfb821371223e8b55f485b61cd7151a20e18afce7c125b04eee3a63a515a26b3163a0a4fd38075d870786c7bde67cce94c2487f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baf5840daaa25c12bbe040bc02c27e77
SHA1a640b925c588d2655da14b2ccc51d04f472dae5c
SHA2563e74f52032280e2fd693887936ba1d8e2e50e100356c30a81a426244d096e79f
SHA512a6e59220971aaf9ba6689037a7b47c4c8831ab6ab88f02ba126ff291d7017b22c06a89fbcebafa86dddb6ba28c2a98d7d350806dba8d0fed7bf835b12ca95145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53623bb2f833548e66462af251f578774
SHA1e206ca6366d16157c3bce8541caf90c8abc9dd81
SHA2565fe66a96fe94432724949083f2ab86293dfaaf3450b03fbef3a02a949f359a30
SHA512e2da132827cdec05838c533a683bc1feb3709d0d2a6d7c180a84e4535a01438a94971cd0d3eefacb6b83a9221d523f5d6fc404a6bb2bc332fc343eeb9ecb38cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb1847e049f1b7119d1349363f36f22a
SHA1f04d2458720852f53bd2aff3234ef25cff469b87
SHA256144160642a252fe49087c525957f6ded3afde63c7916a642bdd21997056ef9d4
SHA5129abc125a45a1f6d9ef7754d443e96451af206996c31a1959a13aa1cef11578d56917302db1ec4dec2a7e5c46b73c299bd10e70529abbd2613ab9921291950b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3ba9d43acbfc89be6775f46e8382b2d
SHA14e31b608ff9fd66591fdfd41582ebc99293609dc
SHA256b15eef0e5ae2a0a9bddf6b6082323cef024323e100e0b49df09abc72cd1c17eb
SHA512397b1e2be9403a90c84f14b0d034d61f698c25ac03227b3c9fabf1119c8db7a094aa7579cef3e8d7a1e5d600552c77dcc7eecd554bd7972aa6e8fde6eba14511
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5389d14f2d5673dba1a10d746b615a3fe
SHA164d1a86905775803afee37dee7157b714c926e49
SHA256ff61c9fe2a69d5d2417ae8198be79ff41769fb85aa8e2c3733dbbe17f53939f8
SHA512cd5f65f65fbc5f564d9d654ef92ab50b39380097d67d0c73bd0fe009d263d68987646fbcd8a0f84a5f188f7aa5db616d34e4551d0b86a362daf7bfdc49ee94b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5977dd70402b2b86415ab8221bc9b4f44
SHA13f84c9d25a15d8b4c354c371eb514cd5ba64b9f8
SHA256cbc9aa2f52b9622678083b733e843d4ef04610974f8ad04107cc79efa09d21d7
SHA512d5631d97ea6b7818cda4272a933a7c8ba60525f3841ddc986a08bcbd16c0ffb75cea434dd12881969f053e975a8277330e293df9da10ec4fc8781079731989d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f125559213610eed54971c17f51c8867
SHA1da3c7db3a4700e0bdd2ef6cbfc91f005bf020112
SHA256e0050bb3248e0f11d603a8b2de06e4d0027c2f46309aa8fd42f9512cd6905e9d
SHA512f5a32fd823c6e425f18c0bbae5f702e1499f1e89f4e263c12e2541e173d9d607da62706cb08900f52c45d5081cfedf9ef433a74aeca125eda00b5dce65a1b8bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca144331e4c3e314c903dee5068e8a15
SHA1d032dd1fe15511c237487c46c30494989632ee9b
SHA256cde48b6ed82841768187d6b9299f72ba396282c49d334c872f6ed3d505a5aa73
SHA512fa6512e5038c3a2f5870fc480cd94b9056831e741ae397cec1b124de68d52b158dd76ec87aaa7f6701af9be95f913f66a17134b0bf94805b7f49bd4230cdab86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501d241c411d7d0df085590c267c75857
SHA14096ee6295342fbca89112c10085219f566115ba
SHA2563713c8cae1c6602aabcf63444de178a30d02c7ef116fde0034c7b0bef7ca05aa
SHA5125d4c958a3d7377511c700b7918207c1532de66057b2868b719d548ba3ecfdc950f764e3e475906bbfecadad047322ba113639411500f3b75c91e06957211710e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b731faa49b030036a08c3a2cc562a9df
SHA119603d7458958670180f7660022a7d0c5fe33a8f
SHA256ddd01abea917bcb93a923991c612f18c91cb52e89d0fb9b26dd94436d04e1063
SHA51237222e9929919fc18ecc7d4f6b8955b41ec4dab89c363f07e9e19ced0099d320a9f3eea24ae13f8a6a5907074050c0534c3fc79780abe89b87a39087c47fcbfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5356e1d83ff5cd6e53282d609743d3727
SHA15da18633e86bb77a52977c8944481430dd238033
SHA25644735a7d764551f436d01474a86f81f79d86481a46523ad3236cc528e06e69c7
SHA512776ebc5f16b2126e96bfa1c0a42415a27df8a26d9f40af40565820cf6469a179bd9559999e32fc8f6cd10182927dac7974cb9585c11d0a2f932865e5f97ece49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53da325b88eef3e5b167e145a60e37182
SHA13efdd6eb6f092784b224f47259be4eae2075fffb
SHA256753625afadf30e060fd31c2d4656f58b3d075d0a2e8faed018a7fcf9a24f5153
SHA512aa086c67cfcc755979a992af7d7a82fdf9f43fde4408d5b7dfc5a7644112103f042d9a9ab43ac1144bc2cba71ab03016c4fda1936adda30d99d8287af13cd50f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54562cc0a526361eec21596dfbc690625
SHA1f302e5062ed291ca3819c71e96b5772e47c01afb
SHA256943b646fff38c8ec88ad99f3190addbcf845a4792d310d8a5000978bbbc6e012
SHA512ef48ad582c514b7c04cb64faac4decd91209fc3ba75d1df9e75a6b4fb7ad6dde61af213dd3cc6dcbdabc7f1d8703657a56de4153959bda715aa55bdcd340ed01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bae7a440461685857a17899f07d24903
SHA1fe9b93ce4967095593719a32a4b5ed774ea3eed8
SHA256da429b5ddc96a867946d975f6a5df7a4ad0cb33eef4757cc69ee82e56ef798f9
SHA512cadd0637b7ce4382a148a773f08d45dfc443d30f0b85132abad81678a7c0bbc6b6e2382cb1a2f9e199bbd9630ac9468d18ec6487be2fcd8044f5ef66a551192d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f89be59d7f065ecb75b424295fb93ff2
SHA14d60f65f9e9a8a245fdf9a584fd1755751748449
SHA2566575544fd0ef00c15adc2f4ad8536b6a91e4b32ed861a95b43aac8a1dc0e48f3
SHA512fcddb15a80aeeba43d74ec0ded2e75d966402e46f50378d0f95845f96094f6a8f262b6e6f0094e97061461db64711c293101bd5f5ecefa13e3a459aef180f143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51977aa44d351199063a12093335086ef
SHA103aaf2b6f01152866c80895979e11310d16c8686
SHA2568b991c719c63bb70baea3b133c00a2a1cbc2bec93b765ef45b8504d5477d48b0
SHA5124be0dd9bb1bb802cd33c4095725f1807a9e7b99e5b71023ef6f4b8907650575b0733cbc6e2490ca63d9ec54288a86d3c901b629987f80a427506a74cbe4e21f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d89f8cd07bbece9e50ad4ccb1b7f6ae
SHA14bdd93e1afcc5be383db78a5fefd8780f6624379
SHA256cc0c7e9b17d191ae1704eeb34a7db91e6e146f2cecf78aa11f6723548dc412d3
SHA512ee8c249bfffe6e8222f961669f6d0630a87d1adf6267ef8a4cd272d31db2f3fbd5aeb547b177ccb7f292b009053c688ec6d8d86ba036bc84b3f18a49f900cb0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f86ff93d51bb85dbd9ef4c274e917029
SHA11101295353956f2ed5e96666039614c0eec9dbc3
SHA2560cdae6db74c09fad27b7398b487398867bbcc7c214eaa17a3e8e3ecb1c186603
SHA512cf1e06199d6b2cba1b9f411121fee7bc11cade22c3871be9efd0ed2abb90de7600f9ab98a1fe2f56f08b52f29da6946f1bc9bd473820566a847d6eb374945caf
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a