Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13/05/2024, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
3cc8838a4986959fa1a0c011dc1fbaa5_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3cc8838a4986959fa1a0c011dc1fbaa5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
3cc8838a4986959fa1a0c011dc1fbaa5_JaffaCakes118.html
-
Size
461KB
-
MD5
3cc8838a4986959fa1a0c011dc1fbaa5
-
SHA1
5592c8362859d3cf60f6580adabf8b5f872db29b
-
SHA256
ce1e38ee587229962c3ac2d67b88f2cbeeb595ebe6b39df4cc2b98392aeea7cf
-
SHA512
0cf540d4d02ff683f0780c13314054898c7d2e5e30847323f33405dd6386fa86a07ed79944129212156705f916ef2bbfb7cbf46897e1a0656b93148ac391983d
-
SSDEEP
6144:SIsMYod+X3oI+YcDQisMYod+X3oI+YrsMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3O35d+X3l5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000db09aac2be83e9708a06c1c55eba14e0a3302b485511541d0e82fc4b63407d35000000000e8000000002000020000000066b98311c0e669b850d01c8f29b909ca71e9715997bd5ea7c8ec55e4208b3c620000000cdd1522e9032b2f5ffa659a20fe31719a72a00bd53c3324c95e3b2665a089da8400000008d55894683d24ed2d1199830c4c6c2f14021df3fe2e384efa806bf514eb1f60a60a720cd75358c87650257799174f5b7564904102ca14b97109a5cb56cc01718 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421800372" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f0391883a5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000bcc0a2a18c97c99431f3159a16d54500f926a60467e286ea7f016054e4508cfe000000000e8000000002000020000000b9147f79a2dbeb5d6da42c8aa07654d0540a8ab58578213449a8e85fd63f3b5190000000710c805bd90d3ff11cdf17b4d1dcf4b3a56fb845cf224441f8fad09b9da55b7571322aec585a18dc8e0f6612ee669af92f7e3b806490aa673918febac1e3a744db63a1980735dadb8499408deb34c93b7787d944fdcda6df3b83be23a91a6b52c6af3564c8ab6d60b88a833dc6983f1d5f29361e3851504143e343f3e1941becbf3779ad150abdc23e5a8c4b27e78bee4000000033efdedd0eb8453d09a6365d3835e2b807b1d2328c5ab75309d8a9f4dcf330d2c5031077d7081083240e10da59f6b84c148ff9f3adc4532305fb43fed461ac1c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FACE011-1176-11EF-AB95-422D877631E1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1836 2248 iexplore.exe 28 PID 2248 wrote to memory of 1836 2248 iexplore.exe 28 PID 2248 wrote to memory of 1836 2248 iexplore.exe 28 PID 2248 wrote to memory of 1836 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cc8838a4986959fa1a0c011dc1fbaa5_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5933d951b0fff8f80c02bb428ee8223a2
SHA121f4a3b5000df0e51f06db5a2bab9ce8260550c1
SHA2561004590261dd2af7eb323ed3116946ebd4db35f71e2ddfe963b55f8a9f526ec5
SHA51269501895fda452b0f3d6fc692d80ed09f27fe12a347437ef6eda97233a7f62086cae01aa57de1992c1b8fc1fd65b84083738e84ba58007da5763f98c3eb1ce5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e9d26d406864df14c06d06178ab7109
SHA1dd1a33caacc92babff40b1fca93a2fe91c7e36f7
SHA256ad8b4dc36e72b7314995797bd460d3895953a0b87e5b316a6c35d37b0cb7467d
SHA512eb59c8ff22f523bae9ffa1f0515a2edde849cc3e931c28db9bdf464170113ecd19cbd2b8b7e642ddb79ef77173b46203fd4f4784d97dcc979d76d6569c0feee1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f49cedbf8e469cbd4d291a5bad1c08b
SHA1c90060e11c6a9b82ed228c496aaee9e9dc60925d
SHA2564010849484945bf02ad4dfde1da9c21821c791fe96d214466a308b105b4b811f
SHA5129c8a5fa4f77f28380370e1993242d1897a35991ff705403c6dee1dcfedb30b75d2be9dd47c896a6a8fd475c97ff2466de8a6fd98e5a2237a2955e3b1dfc76b16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546592cf83aa4b17cdfc14fbbcdb8691d
SHA1d5f94f6c1a5847a142953ba32cd5fea2a91760c3
SHA2561442515772248953b613251b0360654c05e0d16e44b75fd09e19b16170eec5be
SHA512efcf50491bc559f1abc3acdf972395b40de710a3c6928f3bb6ee3b91784e2c4f9e9105b85bdc7d55f204ec1bd525d5706bfad1980cfd9e9d97f3baec90cf0d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52da3786b208251006bc7575b3a1fa278
SHA1b94c423873d454820bda928d896cb9ba620368d9
SHA2569fbede50990f633851bec74f2f087dbfc025233ab6887c94283505590a31e7c8
SHA5124b77e74c80a3a5211271cb70247a1a6606ac8f6659dec4e65e58f00be825e3264ecb355720f28374894d80ffcdcfba1606e87d289626cb7bd6d52cfd5c20d472
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ea0c7f9ab90424dc32ae02ae94165af
SHA1596fbdbd4999703412cadba92c5560a5a908bd3e
SHA256e0bf422a18d9165ecd371122e118ca229e11440193842bd2546b237e65121429
SHA512561c43c0e925459ab9ecd3a41f38cb571299b4eebf7c04de7cb5086fa8c055b9cc081ec3f79e0d32d4220a28cd69495dd228a721449c0fa20a1b0e1aeac900e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500310a791dc7823d350f1d07ef662cb7
SHA1e1fa6ed9e9aa0caeeeb170773cd2312c4ff45074
SHA2563df7b335ea95e55b22114a61677bb0ac89f8428a6681374b8a01b9c121173419
SHA51276b4365d3ac36e439b55b98f58c5f2bcb38497b340eeb5bd3a84e129e65089294a9b2dd45bffc9d735580650bd7588d5b520071ec54f0ebed482c07158ffa6be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549ae032e9006c3b32056b20cbca1b5cc
SHA136efcd083f8a3b32bfbc101b463a82dc59350462
SHA256ef23f969938562a6f7fdef55691c05e52ab5b539ad92bfcb716a6fb7263aed14
SHA51229ea0c7ad4f599029c679041badf2ef4786516b3abd605994fb42918a3751b2b7ea5e5786db3adb78e78fafe2ccd84feee9fc9dbab2f98cb50462a51d6b435b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c5b8e6f7d4edf9759e62900a562f372
SHA191b599200081dca32e46da1146d0d6ba5dc02072
SHA2565bfee1c8502b37eca89c25e8329a07cb426993f27c468814dcc97b324ea01aed
SHA512e52fafbd841093d568742599119fef9a2f95c5d3ec562f299b32469cb87255d83297adc9212f6f9f5ae9f307c10c24af000c70b51815f1f4519d24bfc78634a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5630b717411f67159f7f9472b78f42168
SHA1410a30afcf95f35db66a920b9b3f8f8f1555a1e8
SHA2569ea57db9ecc34d838e0cfe8adff891af629d80c771f1bb7e7c41dd35f5d5036b
SHA512ea20e0b21684208b6a1506e828637d0aeff565ed696129af75ca14ce0a4a4b145f42e1b518602781e646f88fc596675b1821054a9329b37ee58c5f762dbfc4d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591e3d64ec759720ed3408710469b7582
SHA10b71034605e42fac3dd5dd5c75226221ab8dff7b
SHA256f7e52518eafd81da9e3f980f96365449b22b2f3a5637644f61d385d3b62ac6ec
SHA51260279380ecec5771929179fc1cecd66d0aa3e42b0f589dbe5b4d84c2dccb120ea767a1a3aacb4b06f185cbd27b5a22af8873dc94b7d45728c74555d514e46e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e163e26c384a709df725aabbf9b78ac0
SHA1f5e32cd15292eec862298ca939ff5f3c058f23f2
SHA2568f371d08c5a1e7d61f1d3b0040decdd015df191100d8011651adcdbb48fb1d8e
SHA512f39e49e5dd5c7e21623bddd8bc6bb7c09c8ea46aef6d44addbe6cbddedf3d14cff78400432435df5df16ba39710379dc172e939b8e8b10713f55a39d201927b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a097b2366d58d9a356727f51a720110e
SHA1583e4ec176b348297f0522c8ed9f7798847fcc1a
SHA2562d282a3cc86e147fa97d0c148d7618e1bb00d8ab64cbc377bf6177fa1de1bc7a
SHA51297affc51ef7cebb37b51c81336ef7ad10ce6dcf85d56af8b999a9588230a5f305ae363a3dd81a64f2df130cfa7860bf60174093cd54fdcca40b61e5723e93ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5601b01dd4b4996a6154b06436b065c
SHA147efec73377141b768b19ea48f63672f550cfabf
SHA2568911599aa9ffdcf84e61ff3ee288e982fd1fff4be93ad04873d4b07c5a163676
SHA512a8ac8ca4c5e0db57c1da1de4bea89853b9623bca545de8d27e4f212bef66e6b91081312b65fc2b4f94add9cd1bbb6a6622e222b9dfaf7ac503505a39a5566854
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5880ceed9119d07863b123a8cbaef32c0
SHA14a9e6a3d6b236b46f2669b7aed20d72a45e2420c
SHA256e7b10d9a92e3944286a125f56f771e720fab2f20c8f1c728e7be3e0a3e792c78
SHA5123094c7d89e6441c9ae746fa7934906e6288008c812fe6bb0d39ca02c5e4571d338beb6cc8046590ecb637c151215999b953e6275baee096c7538c1598a9cfd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fd866300f868ad03de087f9bb698805
SHA1b59e1645166f50b64731f8365502fc2adf9cd799
SHA25635fd1afc225d2369c7f315081ab924c450f1642426216495ca22c5e50dec345f
SHA5126ac33e3f511a9dc2822782ebfd43f6c71996400224ba68c4526badd0360341f44eabfdde4e3078e03c694aeeac036c78ae9d2f20e0b4d156bd82176ef2b0097e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9aca8628c38f4b464c8989e3fe2b26d
SHA131d10271502f6b8087ceb81149df9a7b7a7f6d6a
SHA256ebf920d14bdbe57d329ac2952bca2ca415144c3fdb317e1f78323612926e56bd
SHA5129cbe0443fa2c395c6f38023e044e227b013f8edcdfa30a9f7ee2656ec21d319955a32ee70db3c42a926535091ac333630f22d1b1a057bf988f0a095646957694
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57126b845a3ff1938297ac2c727e54a95
SHA1dfb31a7d769030bb258f38af83fddbef413170c3
SHA2563627d2e23840028c4caeff37b7d2af535c757aa830fa12fc29f86bc2e8441347
SHA512b117e529f0f706ed2e8570a96df653abcaa7948ae4f106aa9591d0d3ccbbe47909e1a3c58c93934d3736b4d9bd742f324a8c2deb0ad2c4b7bde76c3b8e2130af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c07da6706386a0d91c28eccd72040cbe
SHA1dce5650bbf6e5c79a5f1a3af52bdc2105197b722
SHA256153b75faa00ef5e0be75debf7d90381a132505cfa75a6a07c7d1369268de74c3
SHA512547712c40d1516ac3f37b827af058be090eac3fcf42f14ffd7e3eafacadb1dbebf23e1aa48d659449272b087c994e5b41d455a4046dcb279753508c882811c5a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a