Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-05-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
3c5680e415dc549ccf27ae13edf1736b_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3c5680e415dc549ccf27ae13edf1736b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
3c5680e415dc549ccf27ae13edf1736b_JaffaCakes118.html
-
Size
68KB
-
MD5
3c5680e415dc549ccf27ae13edf1736b
-
SHA1
12b0de9b89d7db84b4e76f0f00845a77378956e3
-
SHA256
0d559db0b1f4371178912a39f521615c7774b6924ccfae0a8463ba837743cfdd
-
SHA512
901151f766a4d4609f204ce73bdbdc5d483f4adeb85585964826ecd4912b609e4ccc9ccd72661210ff99608825f80b5525d9c97813348e6b37168de526137999
-
SSDEEP
768:JitgcMiR3sI2PDDnX0g6ace3wjH3NoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:J373wz3qTcNen0tbrga94hcuNnQC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000e752d279d72aa1ffa50af62da053e7245e1b273c27dfa86d9d938078efe142b2000000000e800000000200002000000056079ea78052e90f185812b28d4205b46393804db1a29c2c0b3530b91ed395e0200000007f650af9277662e5587f02cec9df1d4364968c107956d21b09466d11835de8a940000000fee0bbc752842e749e3bd522b89a226d70fab976939f9c93d2f5abadd8a3a1e651aa5ffc10496ace8544e7748156fc46bfc6740f2022b4787020c1f0a9a1b313 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000055f4b9a3e6d30a33a0e5b9f18b1410c5b6925fa30c001f706370038d0c815845000000000e80000000020000200000006140fcd1e5742ac3a56a9c3034742a3901084bd0df216037d25cb0318b529c6d90000000b6d3324da1520a208faaa4b7faeeb3397e28f814529020e490153bee2b013d47069438fef6afe9db5c669245df614734bc3d313da1027bf9d3a0fa2ca5cf43ee4a4d1f95332712652628c700982bc4c5d88ebf6d41b38a66287d2071d04b2776bde39f408ef4922854849dc85c8798018ca3343bfb2f4403b876f8cbbe0b84075ccb59de824ffecb734b6a89c2eae7af400000007585c76d1dd88dd50c92b80850897e49bed35a19e2d1121ae0be65f6b9e9c52c2e4df517bedc6b55c470751959dbccdb1ef25b0a454af29a67926cdcc7ce10ce iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CB192971-115C-11EF-BB1B-4658C477BD5D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b5c69f69a5da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421789438" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1036 iexplore.exe 1036 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1036 wrote to memory of 2704 1036 iexplore.exe 28 PID 1036 wrote to memory of 2704 1036 iexplore.exe 28 PID 1036 wrote to memory of 2704 1036 iexplore.exe 28 PID 1036 wrote to memory of 2704 1036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3c5680e415dc549ccf27ae13edf1736b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565fc028982bc1d04f404e7b2c0c7faa7
SHA1953b0204d0c2f874148b4297b0aecbfee4532d45
SHA256bf6b7b59838c8a94e721b8f1ca1118afb29f3087d0ba7d791342a255c9320d8f
SHA5124414113c805ee4dac36cf7bf0e937a29701ae9269ba3b9d89605b85a269ce2c120a3084bad9a637c2c45a4da5198539af470cfca93c88da25f1b4417dfd0d8c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a145fb2b6fd0d3f97d0ffa45b10da2d
SHA1edc30108c3842e2615fd8a798b4d676fa9c2df2e
SHA2561e09be8a44278da09c1148ff6edad9112ccf021b850b1f400d41397b251b5c2c
SHA5120de7f8375895747cb153a7ff9e2d0115467f52d47a0c49da7c964828e6a7abfac9e7a4999c676db896a119dd2b8b9594826207ea1353554291966813371ccc61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554c99cab3b30a8d6a19c2aa49cbebc86
SHA1009d6594cb55c52f704d16d37eb9b5a4c36053fb
SHA256567211a0d8abbf8e990c61ee01ee50bfdea831db0e7739cef5add07a9b671c1f
SHA5123c03d82cb047b4a935cae3d9865ccaf9b00205a61d53ecc75817258b5e17f92f97a4ee2263d5ca8e18c6599c8d893643b96584839dfc87321b9b53d721c83466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52141f477d8b6c32e1909dd4660c7e1d5
SHA1d85356598e74da7862112c7745c4671a62262002
SHA25624dc6e5e439ffa2afc7838b27d684ab00a315a977369074411b9b470def4bcd6
SHA5128c84019b85dfd953894e615fbdfd183f08175baef6f6e6fb7bfc132cfc2d788ce452bc923bce8b7128454de67c1bf012c3c90ccb916f6a7a01392e541ff0293c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ae731e40122d3c36d70ed960e412552
SHA1860ec4f7719fc2d78b5f8757bceba8c9ed4ba555
SHA2565eb4a6fc4222d92df18a5fccaf54a94edfc0da2fba2826b2f44435c9f9f11d31
SHA51263610427b73cdedd76c4d7c4d7029be96033834270483b47eaea19d333ea4f9c780804eb40d9cb7ebeb44c6b199ee233f43ba758de3890455f540cf1d23df0f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5416437fc4b031765ecc981091d8aa0a4
SHA1a7cfe47133a8940d72d669270338ea7d4a8d3a81
SHA256f3eeef057cb3d80bfa37c0f806dad5b4ea499a7c36ae98314663cdc706c89345
SHA51207083834e85cf55fc27901b7c793d7c25c644a65184d4dadabc5ddecd1b5d89b2dd75328fb392f78cbc5ba6a0adbf43ed37d4526e726858cb6fa8b68643e72f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595d034597222a1122380ef0bb739dc27
SHA1fef7044a7238f86c8bb42bf81db4958a5ab35f49
SHA2564332514827d3eb77ccafa06bf98c2caaad66754883e32529d6d6002220bb101b
SHA512b8c79ec88dd3e7aedbf698465d474c144db1e424718cac18c33051045cd1b5c78f95df59aaaa4620b89743099f87b11299b12d42c5973c8e63e502fd8d50ea86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b275cb77bf3ac8301b3d1e81454dc5c9
SHA1504ff71a8fdf294346301bec10eb825803454e82
SHA2567492c5fb5aff0cfed99bf16ddeb96880f8f38fc02cbd8566bd8e11cc5d93c3a5
SHA51298aef5a9f184309c4746d5a2dda002000a7612052c4cde4544ba119637cd133d943204712473615006aa8045825fc5d8eb3c99db2b4cea193109145e4f684d55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525d9023a7ad541b55a188ee48bc5ddd1
SHA1625633fa7bd851218c873776b390a96c007618d5
SHA2565d99636729ca3122ffea20cea54ecf20291ecf265e1eff7165d7923ce63eea6c
SHA512425b8ed4cbb9477633d278dbd06f464820da1da6947572c30429bf6cd751e9344f278dd3e0262fe21c2a32550e0b9c0d908040a02b3bae45792cf64f181223b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1c023288ca7f3e6c4e40b190fcfc6f3
SHA1dddb74d5e30c0d6a1772a1035c7790764900cc23
SHA25621268a18d528d09eca95200db7af00e8f9856ae47bd98e3a6330001ea5036dee
SHA512320f7a7865ab1e6e79714a832407c19aaff9ab5f825a42ecfe6d0072b6b2c6b44fbc806021ff17e3e773485a10081dfa42db6744f14849185a35d3c5df826988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eec14b2884261fc03ba6530217afaf2f
SHA16aefb73add44f16ffbc6d9f0baa9c6a35a671c32
SHA256cd3374c72932de5578fe2233be6d2ed1eac7fe22f6081e355092b2fe7d397b21
SHA512017eba3140a9341c73dc39fea3f3265318bbae44745ce6824ddac0437d1de4dc9ce3c56e732345f4cc94ada31d64ee5048eec4c83057126757e88734a84376e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da10051e7210c55a68ec6006f81ac058
SHA10f1884b87ee9ef33073ae9e223ce4a4015596da7
SHA25650b6b631c8732a029ab503adba78157c396b8d6be7e2482ee6bf74425c67184b
SHA512cbbd635c4f143f7ddea64b4386ba04439cbea707a10cdad15d5d5deb071796da05ea25ab1a2c7b362d7ceeab2b7b09f1c99cc208dc3566dfd1f3ec551d0ea0e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd4f4d6a5c39766f10c8583c2be07f72
SHA15187876890810fef46f35146b7ffed76c4c02680
SHA25658a121eb68b5ac6b1422144d4d07793a53e1d846b95c9ea0d0acc5b8bfdcf1cb
SHA512b7ecf8a0a78111ad14d54e7e91a8c90c3cd410cbf8b770381404639f4285db3ed01758731bbdf82d6c28d7e42261fdf8fd62fbe3f5824600c8e30585acd79446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ba0da137a7de2e99b8b52458eb373d5
SHA13337c8f8f7ea29cdb9f61fe8374f63fb1b071e47
SHA256ca307dec8f161e029ec906d381d8f884e5c9475a9485ec43674893ed80ff8ff6
SHA5120ec1b2877f8ae27182d323bc5681c5ce7c88e020a9f58be39dc5b6b32979fa1fc29f915c2eb229babd50101afd2bcdad057c60f450b192d70b3863b802d72d09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c9af17898272d5bc80667c99448dd70
SHA1ee6cc909e42998aba258f7755f1892caf1efd526
SHA256f3ff63970013b437a285cee2911182e6f6254c1b24fa5365aba6052e79d083b0
SHA5127bdf46ccaec5e6259a62aa6e9301b46b766aaa57585df4c691bc27543d52caeba6e90838f707f851b9fb98aa7d0cfc9d6470fe10dc2be714871e742ea7c5403d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50235bc91c929c1acc010c46035f3e67f
SHA1e368f27067542c70235f689b1e62e67a099198b5
SHA25692f4c99d3370816291aa00671b7c70f4f84dcec2e48640caf58e9419ba9aacda
SHA5127d62bb852505959c90b0f1b720dbe2d0949f0f686b6fd7bd8cbccc26a61da3797010e7245c00ffeabd1a768685766c3de6feb26a5ea80862170b2a6481cec3d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d3178763fe2412140c65f8deb6db4bb
SHA1e8b205f3f1b8beea5b63ca6f53dc9989ae91b124
SHA256efd3eb0e602b3e69b98540ac29c55851b285fed240a832c8a9fa9808007b2b6a
SHA512f9d15982ec6ce78bcecd1914f5edf292f30d4e4a599291a044f3b5ccd698020f269220eebb475282dd7274e06a1b499e77ecdd8e5d5f808b5c5418d03bac571d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545376212f347e37be7fbc9a22bce3190
SHA13893da306dd01119967aa2023061c3e557cb2c40
SHA2569b921c7ad7138419c567b268fbb2ad3c1fcac447e779671ed5cf055f0673e01e
SHA512f1b903c3d2f32670939f54df12c0078cffc3caef61ea79a200179817ce2cef0a9bae6560996ebf211a30980d0b083887d252378abcd0bb168431f490ffe618c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d41f2d8ce4264a336ae5b3000c0ebd
SHA1fca36380069c9bbba50a03664bc967fee6c6dc07
SHA25651f260439ddce22ad11bc2eca5a7afdb1f5d0a70889924cba7d1b80f6bff3e01
SHA5120de2f5f49943f458deb75f48ecba5e372f28f8108fda3dcf9f56b9621ae44cbc5f7b922ec8ec1f6cc59f7e9333be8cf9f5481cccea7981769fa5c7075f3b578a
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a