Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 08:13
Static task
static1
Behavioral task
behavioral1
Sample
6a4ecd606b0741f6d0f68c912886d293_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6a4ecd606b0741f6d0f68c912886d293_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6a4ecd606b0741f6d0f68c912886d293_JaffaCakes118.html
-
Size
32KB
-
MD5
6a4ecd606b0741f6d0f68c912886d293
-
SHA1
ffc68b97de75edd6e4ea03987ca10af9c65a4e61
-
SHA256
a779e95f881053f09d671496ab3dcfffdd0e0589ebc93e1da00a69d286b5b441
-
SHA512
5e6e72ff20f6781f589072c6998476600f67e93a1449bd1c5fe0036b57e64ca4970c22275bcc298a3a858d83298127ebc5e7aec8e930fbaa73de21e8152edca0
-
SSDEEP
768:GZEDPCKHl/uukFhM2UJ8/rOLlEb33g60E:6ETZHlWukFhM268/aE73gc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ed689c376e37836da6718f9b4d807883f5dbdbc1f59ab39e50e7842a12ffe94e000000000e800000000200002000000018cca3455d5acdd4e9c391a3134ed62cf2a5b9ce1a29f19f151ee30d633a4e2d200000006eb8cad90e3bcf5586daf6ddd259fed3b9f7bedd0df80e7a34345bc7f32fc0a7400000004dcf3c17b7368aa3120b4d88c24b5e95815ada8ec352322a07e899e73548fc1246e099bfa5a41d48a5c16bf25f5334ea158699838e7555019f43479c63c1b5b8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000a18d2cdb8c334729e454ed439401ab0de8e60db45ca7412c005ea54e662e3ed8000000000e8000000002000020000000d042beb4cf12de6994d8b1e18c96324400ca183aef013a90584e7452a38ea03090000000885d7991af0e2c49fa5e49d4bfea95c19d748957964b1a8615c200ed13068d4f27b6c75c103d241724acd3ccb6ae88774c3308ab489a96c583ec47c5eeb66203a7033aa0878fa30f42c21061f13082eb735355d82515b38189260c50e3a54474dcf2141a1c84efad48756d923d6175eedace212a5341dac44c7e9ee8557d3b59db508d651389d7eaccb44639829f515d4000000029ded3fcb2f4f80bd2c70bd0863fec9b7868ac602eac2f945ade571e9c955881c57c785e9589b3fb6f003bbb00b21738df83dc0c62147a0a0e1af95626e82cdd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67B4B2F1-18DC-11EF-99EB-F2F7F00EEB0D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422613905" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60475e3ce9acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2124 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2124 iexplore.exe 2124 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2888 2124 iexplore.exe 28 PID 2124 wrote to memory of 2888 2124 iexplore.exe 28 PID 2124 wrote to memory of 2888 2124 iexplore.exe 28 PID 2124 wrote to memory of 2888 2124 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a4ecd606b0741f6d0f68c912886d293_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6c424e9bd480e1c71b5f6277b2df356
SHA197c27ba7151dd8d6d24e1c46c5dab007980d3031
SHA256448522140f4782fa3be32c089958be2f1ce0c7d14e551fc0a8b66e5d5ec09a10
SHA5129beabb7d34121423723e43da7c6136dd131b9424025fa310302a84e1c4ce2023bcb2901ff372568dba42d168ea6791a19e8d17d9acb7314dfcb36ba868c91512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5427e5ab391c2d1c0dece2fe5ac0c0907
SHA16aa21e3f1115db48156f8b2e238d5d73abe95d47
SHA256f35ee21d0ddec85947be48f411431305068a88e26e2989b04c7d1ed49c194892
SHA5120c053d5d62dd415e375763842c83118b01914b6ec3e85304f31c959e7cb117c2112fc3fce73b3073ac3775196102a7065b3e7660e691da5674f9c12be7ad7ffb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aff1496ad7eee0dd6e34bfae95b62613
SHA1614d431d841bb89360947e47b7b219ac6f1adb0d
SHA256d6adaff6f0f507d100484715840074ebf67e38414a72133ddfecf1e6b4dd4414
SHA5121985fe34f9c6e44fc8cc5ad2c1a6020f08e9c1afb8683f567e9770909d7ad8246ec3626a046f4d9f6f5364860b9809f6e7f1c996c0ddda940d08ef7cfc5b5a43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d03265d0bf07b97196ead691b52f1ded
SHA1fa3cb91d47727de34a2a38d636d1f93ec9a04987
SHA256f6e8de8b51d4d08f37ac71d5f1ffa98bf1b47f92261cc4adc369c0c87e050b93
SHA512c600a89a9e49e3f83e12fa318fa80537c7675e00fcfb190161d67486f65006b53b440edddd0e0ff85dd9258092109d85d14f0fd78abb1c1fc80699be75cbeef2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bcf541a93e27528f6861350059f62fe
SHA1260b29dbabd8a1bcc7d871d1f7c73a7c75830806
SHA2564ea94f6c4f576bd439bfb14043ed93f03b662b029a3e2a2f39cea9f5e57c4ceb
SHA512a5804f7eebf6571568c7589f1796866830d3ffee395d4dae51451f1c87705f48b62579b921bd5d286b5e3f7b501d769508fc1c0b342afe8d3f5f383b5e4bbb87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dbb19d0bb083bf7c78cb1dad3709cb6
SHA16c5bc24284f6968aafe7b29750417798156dd9d2
SHA256775b8dc36a894fd954a57c67c5202e0f6c655085f8197c2af777adb43849f558
SHA51250980bdb0c5b9ad7f4c3eac3e02f3d21d9c2cf5ff92e448dc91bcff7f77650aed07b37a58409db698dbd9aa67c1ded98aa9c6a92bf52c5cafb305ef7f4898c3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce4cb4a692a95b49d121a89fa531342d
SHA1633ed51e30656295ea7b76a24003ae11651644fd
SHA2560c0b367651b1ef1135406161e91c407f54636c1524df26031d1b234b2b20ced1
SHA512811297a0a5d41720c4b24c53bb1766229c22a91c660f00361e42d6d86e8886bd18f9687665214425d8b001a9a585267d95033f389be8316267ad107d74d280c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5303c0fdba1e92ee55ca778507a27d50c
SHA1e89ce091984055566e97796865ad432f7f171a11
SHA25609fd144b83e2b92dfce6fdfb2614be95084512f80555653d71d5fac8d3f37bce
SHA512fac2b8e2d0bc5f86d404a001ad709e82ed0c2d10812c914bf4c3733180ff9dd7974d1a384754e8fa8f19b692260b857eb7a35a2b319628f7711031ff899b26da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8f526a08987b02a18cadc7b6c6c56d0
SHA1190df82db54d8f9f76c0fadd75685783b32f2905
SHA256a3ca30b8c084952e6a4384db1b77f9da4f159bbd03975ee6f1dd3b2f46aac84b
SHA5124bc597b287ec377f0f46b985e0c03c6ef6d598235644a7805c2a12d9d68934931d9d3d7c575578f328017bd669b09164ddd54f7a5993720ab413c2526b4a0477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5019b7eddde0b90b27efb314148877409
SHA118bd0a0ce8471ae8b7041c3d77860c3cac4b618a
SHA256c287d4bdb475cd2ff1a01bce7c146942041b83e89ddcef6be94fe0a259214fc4
SHA5129a74a697a7149a58420a7a2e8c5ee08d190f5f3dbe9fdfcca48433a78fb296df1c2175c8a292f279e22511c522d4d8c5e7583c29d150afc5e6a35335af99038f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598108aa2cba43b3da5e6420f4b1004ea
SHA1aaacba4d9ec0f3a902105fee4404527a314b6fbe
SHA256e6f92640ff068293763efc0612733bc43d0b29e40daf592d754aaa1cb890ba8a
SHA512e85957d3e7307738e9264ad24f0ff7e08983d75234363e9747a828251d0b7dfca6ae91b6fee5cfea56df5ce012aa5f675277ba91acce13eeefd7e5d82ecc9730
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50395be656ea84250a31a2e8cf7d0e0e1
SHA16d43b6b85871a9ee2d03a95a6aaf189cd92e2ef1
SHA2560bb9040a64fab1a2b7cf40101577c0b0d4f9e713ff42395e3721e74aae92a65b
SHA5121ba0ca82747e28512362dee617fd69defb1fcd738620ed428fb7991f25a13fa20f89f509716ea21cb2e4579e42d6794510f493e8ad4e0458135f6199079b7264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6f224f774bbe84666e2b024ae398e92
SHA14989d47641b52a43d128a0fecfeb3ef4a8144cfe
SHA256b2d0cf08cb6cbfd9295f17a75c9f48ce4f29d5fae324cc6924e13e9c6769d030
SHA512e4cd7dd456561fff09842b84ae55b61d87c535e21badaad83309f47fcaa955c520c072f226c29f8ebf6b7ad98dd4edaca4f9f986f0a71c1506374b53e6abedff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51269553d135a193868f1797b7d3ad818
SHA1971fac8d7a66908750903f4ea7b8725ec3f80c98
SHA256c1efc43d23d8562198d32908b93833f8851becdece11190c6013b32ee4cec828
SHA51252a2b63e68601002fa30ed189014a4e682c8dfb42b474aa069db28f2373f3bf8b913470733b00aa1e7998464bbea38747d118d037cf13f46d0fcc1ada718eb7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5214717e7e175e857d75bb0ab0f6ef275
SHA13b36592fb9e32ac057a6b84103a5d581b5541865
SHA25627af64b5324bfcb5a0e7d808df1103bc76984790575b38336c44887c636a859e
SHA5124bee5bef5bd2dc217aca520b3a19bdc115c51ae7f608c36bfdef067c77f356eeab40eb88f146e97d62ca30c62bb42f1b0b2ad87810db4fe4570dac25b9a83f71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515adfc65e22261c0f4f0196c85ba214f
SHA1979e04c197bde41317107220207a900ff26fdcb4
SHA256953b1ad6558daddcc90519e2dfc9bab6e4945d4a71369604875287760ec78b49
SHA512359c4218134b4f7b1e4adfae4d8d74bb10c73d9597f450136b13ecb0bafc21f2dfa258650b22a78406da37a26b8cda817d5f16fcebc68c1105bf6119abe23e62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fb83c76ae06d7cfe7bc1d939f0352ca
SHA12b7d4d5b400562a657006a9032dcca46c315f039
SHA25666de171189a580583eb2d70ca4f93ad7de7f3883978a76e54763e5896b1ee5eb
SHA5123c1aebb5dd71966899f2ef3bb1320fc5d9c4fb221c317a724a37066ad8b991d693b7ed4b99415c4ed17b921ff709b0dc148d51e169ec36da463fdebba9992cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b86a7d3dbd0fe9bc21841c51a4b04362
SHA1b70c00bc3ed4f906b22fe9cb799e38673e57c2a6
SHA2566f1c8b024d6553d62e10806b1a7b40e0ab790c1a918391ebd9ca592e34df5278
SHA51285b208dde957f9b136b637b7aae8dfcede562d6ef2fa31fcb936650d05cc0dcca1d4a82a6dabeab8cf1bec36cd012977cec403cc3bced79e95ade259bb86e2e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51789aa466169d361c1d2bd2c2884a06c
SHA16809b007937026d90f21fe7b2bc57828269d0d84
SHA2561d5279ab0642ddc37627acc1a55d0fa51d0e0ff677685abbab55e54031da2cd0
SHA51258d2932ea99ead44d3448c85604f9ac857a7f46dc2502f559e018ba8c808d252af6403ab2de468ee3d75e05d8c0e961016d6732a31e41a9ea0b228f3b2109ca9
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a