Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
89e8fdcc47ad3bfc2c34c4e5d293b640_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
89e8fdcc47ad3bfc2c34c4e5d293b640_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
89e8fdcc47ad3bfc2c34c4e5d293b640_JaffaCakes118.html
-
Size
557KB
-
MD5
89e8fdcc47ad3bfc2c34c4e5d293b640
-
SHA1
ab40e3517153b54a4ce13ce235c23bc2e9e7d9f4
-
SHA256
785adb709bf59b61f4b7f39b63c5855cebbb3833d64e89240c668db76aeffcd7
-
SHA512
53412ee6e5b0d0a5c3cccc68bdc0188a0ec127e885c5da9ed1756085b32318895a646251bdf2ab555e7a9adaab34de13d2173aa734b9a1f290046ca62c344dc5
-
SSDEEP
6144:BtsMYod+X3oI+YusMYod+X3oI+YusMYod+X3oI+YBsMYod+X3oI+YwsMYod+X3o2:v5d+X3a5d+X3W5d+X3L5d+X3k5d+X3T
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423393140" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2BEEB91-1FF2-11EF-9CEF-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f946b8834fb1e846b70ffd9483ea4c9100000000020000000000106600000001000020000000800e9e5635eeda5c088b3d6cd60c3eead5a015cf8a4b3805078cd9d9b1ea4b1e000000000e80000000020000200000003dd0f05ebe1dbd976fb847c3bd57bc18c0b543276fb345183e38d40cc2857551900000002ce0ce8e34db2a125bccb43c13bc5db30076ce1a2af00b26046f228688ae3b1dc72589413256bfd4e0f8c284ccdd1d55425defcf25b46ed94b2ef11def80b5c11f4315b960f3c80c0bfb7b46595f135ece51ed35ac8a5250a631a0e57271ecf5007744e8dad7b367241718b6ed013ff3bad18a6a368042905922870b9d9fed229e44af4b318f1571d00f54f5f32807f04000000072ecfd40859d376ae00bd3479dd6e4ca199066e7fa49540ad2233191056f0a71cb92f55195d8cbc2729f3e30258283deebfc7277075058ff64e70dab57655240 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f7288fffb3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f946b8834fb1e846b70ffd9483ea4c91000000000200000000001066000000010000200000009f319438d02eb161c9f0ca9d669f9e2cbf7d57a15f85fb86be740426e5c5cb97000000000e8000000002000020000000e3ba013c85483c24ba8e0b9600123e04269b5ff4535a82189f8209149aa9a4fb200000007317abf65343c0838171ccb51ff20ca5f04e9b040981e42c99eb1cf88574169c400000000f677eef568e2e44ddffaf6c7371933f044c8cf2d6f3398488d9a94709508e4518d80ef7b448d0e1a32c2430aa17a70b019e727438f473c59d3500eb1e17549b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2756 iexplore.exe 2756 iexplore.exe 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2212 2756 iexplore.exe 28 PID 2756 wrote to memory of 2212 2756 iexplore.exe 28 PID 2756 wrote to memory of 2212 2756 iexplore.exe 28 PID 2756 wrote to memory of 2212 2756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89e8fdcc47ad3bfc2c34c4e5d293b640_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51ca2ef6354ed8d06c5ba4bc0ebdedcf5
SHA19ddab79cb97e9f81e71dbb46a087bdb4e832a6d3
SHA256126995ee1fb5890d852b50c839e607acedb320e5be4b30fb677097a5b24d177d
SHA5126557bb6ba9dadf19675f7b939952adb8961a4ef3191b012d0c1dacfc83a0a50a8c9bc217292fd15bedf58825a3411a2042c8a5f8dc026356d8f26e4de1d71842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51db6166caa1abde00aff13a96c4e02f9
SHA19ece7a86b971f31c9c4617de6ed9c6a63a928953
SHA256947b79a19b7aea75b530cf96be10fc9ef6f6cd9c23f13e75755292ea2dbb89a0
SHA512a6c12370d520fce8586517f4a80cd1f2682eb59a86657d4d04dfe5eeee85e019f3309fe7a0b8d8cdde1f623ac7ce2ee9a7218da726445cafd2634d86c0100ded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59159a01505bc4070291a20700e45898f
SHA1aba1f20236f1ba321ec82c45e65f7c8d523b0802
SHA25689dcb481a9ffd3efb7ef874a129163770b3585498fc76c457a8ea9af778e4610
SHA51281305da818eaae3d8f9e79c8229c73b3956eaa04417dadef996ba9716f481f758ffe7a5ec5fb17ba6696b4104f620f634fefdfc99a79aa2b2538b4b44737eddc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4402c21e73e0dd2e0c552cbaea7f12d
SHA18c352a46f679293aed7dc68062cf1e8ce99bbf2d
SHA256e9d88738098080a00ccf2dbe38578677d49364d6525f33aca1dd7de16093016a
SHA512b3754a4dc5067f7d90c3314289a8bf95d6e41bbbb78fb180b8428dffae13f8aa82e540018d114981ccdc34b965419d324f11462ec1fc2fd4ba402776c3c82bae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c062dd7d147eb89eb073ffcbbd2ee68
SHA1da5d0b444e42efc3b049046f044583f88536f6d3
SHA25614039fb5789f90a5afa8eb80e8830853e5f516237aafcdab10cc9a72ed9da61a
SHA5122c4a772e5bc2c2bce32ffacf68ddffe2c9e89032e6f0dce936cfa671271868d9da795f4508b416664f750477ce934df809ff6ea63f138eee4251cc3f7334e492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583a30425f22f38a08a6c43c37e7d58c4
SHA1a7aa96e569addf623fa89166663d231f15ffc1cd
SHA256675ccebb412c6e3d5076bb46ed7ec32077a522230976733b63bdbbda2f6923c2
SHA512d8e9c6faf7a845f179dba107108b6c7684f0dc911746135366e0c4d9fd48f6d49966e41f9165f1bc9ccf41c25af5783c7f78fc37459cca6d27624531fa47740e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595fa4ff2308150e6726fe94d3a47e3b2
SHA1761b0da8ef19d3df21f540e37435cb1afef32c34
SHA25672643b1f54199dbf75117df1054ead27ff853ea71de81495feebf326b61b8de8
SHA512647f12d7a566116f3a0b86380f74a1751fe06e026e2153c971fba5bf48a7ca8275ff8d96d73eeab33882662ba02f45c9660da8fc7e3b699c11ad4da96ed09c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f39738b5d6b2e794a27a70736781c0f4
SHA13c104c1c5813bb7e8062d4fd71331b6f8b714e13
SHA2565a276f931e4f7c10ef5ba01d9a5b72227c59b2a7c2bc2afd65f3f1cbe326ef42
SHA512466c823e869e2d000eeb950ceb64093c6e2f99db120e13c8512173440781939dc9bd016163ea40f1173b5186ede962c65abc377f519ba7937fe43fb1a80da74f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce27da8d2db27bb807707d740a250968
SHA1cfe171b4a8841400b37589510759ad61c4418cdc
SHA256a28cfb23868ce622bb7e96ad61ccba23aca30d4e518275f480b8eca7b5a68700
SHA512f6e59ccfc8f357be80bae5b7da12573ce82d13ff0c66f831c5afb15fb542214b7051d9e4aaf93ab1168b706e562939c0e498a0eeff97362eac9d9682fe00297f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b183c426aa3c099db2b8a697a634e496
SHA107e346a769afeb57ace3324a62b35e6747756da1
SHA2562395f65ad43a038f91b42f127046febd8f2969785ed34417e506f5bea3947c72
SHA5124fbe6441850190ec606382db5092569ae4fbe62f46252825d79b3198c1e8dcea2058844a063d7a4a7deb921474a204245c051e615cbee544be2a73cff10d9a47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5364d66a7e3764752d0df70b9de84477c
SHA1db527c179422e0354a45fe2ee0800b5405b684a8
SHA25609981d93d74e5422d3b2d6f723ac884f52428a862dd52ddcbd1ffa8fc49d723b
SHA5127dfd671ebfa5e9bdfd90f7caeb602d5ff2c891c6dec0e7d828b0f32438417ba03adc222537c1fe20e2c31e80254373ad7993cf34f0a61c99c7a0620be8d48a38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51790aa5439f2502fcd7d6cfb6e45486f
SHA177c9568911187122aba3988128bfe4025637ba10
SHA256723c559a96a742cbf4209989038e8f1a28fa55527687e41ba25ce5e921d5f3ee
SHA5126dfc64c269fa1a046ac935f244c56207b6437fe60342e26e4a950d517b958eb04ae8d187a27bcce94eec8a17f8e1584264a0a52f2705175cba633df6c6d67c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58e09a26987872c54d504b8bce570fb7c
SHA141cee3639803af429bf892c23bf11d3bb649888f
SHA256936fc83d4b552aca0c016b258ee10dd6d1a72775ed462c420ee6fda354664446
SHA5124487cfd91cfcc52b8878a61deab086bf917cedf8fcd79d72e68d859a075712249e83a7b1c8e13ea46a9e3c666ed0f44d54c35a5298fa5dd2e03edd4a133ba421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD551febaec3a9ba36882b42c4e09c9fb34
SHA1aeda6578cb7c064b6e05b6309d9aca27b9371f21
SHA256e340a18441264658a7a11f066689fd32281d95daf45f5a58626eb1ae8f1c1c3f
SHA512d49e1062f2c12de0d95634ce22921a1a965598b28b4c480c2b4f81a5cb9c9a13580806dd46cc751e69b3e455f2ad120db6e46bbcfca08590cceca5af0329eb28
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b