Analysis
-
max time kernel
137s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
a772a20941730fecc65ba395557429fe_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a772a20941730fecc65ba395557429fe_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a772a20941730fecc65ba395557429fe_JaffaCakes118.html
-
Size
4KB
-
MD5
a772a20941730fecc65ba395557429fe
-
SHA1
6afffc70bd4cf777b624173e6e93016a44a7c29a
-
SHA256
af5cb17ad32c8929086e8db345eb1579037fe6956b8a29653b8842ce6328d74d
-
SHA512
1d38ee4b38c849bdcf7e7c97262cae67892b359e64015122b8d91b5bad022c09b8bd2d8da6268e3878488756e109690406542f9c290842547c9303fccb7540a5
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ohBqw6cM:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000977fae10a414b840be8079e41ad28469000000000200000000001066000000010000200000003977dff445975744eed17f290d868e9f55527dbf8b4b165498eb2d02b8f02c7d000000000e80000000020000200000003d1a91078cbcba42be8c19e9a781ce12e30f54e5cc022e19934610694fb380e020000000cc280c1d8c193d1c88f7cf3f512847779e68696da393b182d35a4eff002b8593400000005a9ab6f0f41a1c8c7fdc59d3fe9a25ca76218ff8980530845262d84dc38007668708d094e73a26651e6ff48cce7251650bf1cd2a0cea20dbd0564a3c525dd5c4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000977fae10a414b840be8079e41ad284690000000002000000000010660000000100002000000077d8ab7c818880763035b9fa235f5948d1cacc46e073476edc4dd935f032ffba000000000e80000000020000200000009bf42220844e28e321ccb2eaf41f56edeeea6b049058743d98e77799f807e394900000001f60c322b48935b7e5807c28790af3ee76d2cc00622f6522a53b5386680f138d15f8308b668619fe8a2db9d40f99c8f33800bce7f72c9372e55c2c03d19f8a4b46e14d8e6a36c1c14229ef806336c8dc5ccf4154838f5b5ecdebe808b554d0c5a86cbca2f69ddf5c030c7575f8e209bc5e1846a70f48b1b37aed603f86a28b74a5c37339450aa70f4385fde702e9c17440000000a8d602f7d3b3ee1be7246f63881760abf1b13ffcb2fe5a9992569a2d1ee547670b42bfa47fd49fd7b9175986b94cb831728349aac05fe26ae4c8f762d2a3096d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E55338D1-29E9-11EF-BECC-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424488873" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2099ceb9f6bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2148 2928 iexplore.exe 28 PID 2928 wrote to memory of 2148 2928 iexplore.exe 28 PID 2928 wrote to memory of 2148 2928 iexplore.exe 28 PID 2928 wrote to memory of 2148 2928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a772a20941730fecc65ba395557429fe_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afa2554a3ca25bbb0dbf6eb14b29dac8
SHA13e3f31ed7d7edd7980c7555333c3c90759c0aa4b
SHA2569eb32f611fe57f8079d9983647c4ed83eb467aa19b4c2cb76f67524aea2bed2f
SHA512784880f6ed4eae8608d0f50081f97855a01c1ed94e3afb71c02829c9a0b0059ec364af02b48a1ba27288b1b9cdeb8f972355f7580bce725573f79fb1055900d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559bd39376291fc4eb43b5f504a4f41e0
SHA163f855312725b4ebe17183034504c39c898d40b0
SHA25693b21249bda937c75ffbfca4fdc5bc1611f40bebe568cef98a348ca9d427c98f
SHA512b2a1ecbfdfdbaa930f4000df7c4bfe59cbd5165247018eca4eec0ee5bb642812e8a32564b4559e0f1755b29e0d9d4ead91c6c9245af5f29bbb8df5b1b87bfeb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8589a6c63c5d7204dfb67e8ef68fa9f
SHA104f6fe8813d3c81611d5a860af196958c0f8769e
SHA2568b09bc724914b941b7428a820cce8078afe52b3098062e148b41ba1acffeab25
SHA5127452babe7289a99633c9b1cc9d5813cfc5f26a8e7a7fc199528f0c7e05459d2ca3141d5f981aafaf913874f9857c4c23061770468763449b1608714a9a5aa44a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541b564ee2daac01bc1b4be4b656cb6bb
SHA1df66b89c85c4581e8386fed7a73aca708fc81318
SHA25691d9f9a6b34bfd6d13d0b2cf24bdc21cebd21c7076b6694cb757aeb564fa9795
SHA5125a0565297f21daced00c25aff58d873263399a9cad5b90ac3f0939c37039571e2736ebd2e75c87168918aa14d728d3269a5dcb0b34f172f8367001331d226789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e2d83e6bbc7c6dc836247c8cc167dcf
SHA19d8e43ed1dbe0361edce16413ef4632a6675b43a
SHA256d16fb410b1dd66f7249182921a1c1b21b7a78b0699c108935ab82e3ca7511edc
SHA51205e78fb8a0b64201836c41809c2625052e1e5ef74f43293b351fdd171e7f765134bb2f6fa86f85e0bb86da95df83f1732ffe74e33dd09d6437bf73dd4e1bfbcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53b7d8f2a5ac510970e363fb62d422e3c
SHA19bc7b5c5b39323e3fa1484510474d1e3bed73cfd
SHA256c62f8a717771bdfbe9a88b52ae9c5702d65e65f27fb3619fe0deda86416ba03b
SHA512a4d9da58f7195a77f756abdf23eb974d0ca402ee2dc01882243a9e71138b0ccfd7b777d03840262df35e1c46fa1baf41864b7911f509a92eb247a9d135773f98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4f4bb864eb8e6906c20b65a8213fdc2
SHA155ed224e49a9b1eacfed833e5fc6a6f3135dd750
SHA256af5d3d3d29bfe71f0ae0ab6d0b9986d5053aaf9ac772d5625182893e262900ee
SHA512a91676a8299b2ea03b89a8f1a1de05a3ca3eab4c06e704c6b4c4688722802b85388fc9fd876ebcfb9f95c8f5c52ee8c2787a8be4d02c164bcdbdbeb82da6d0d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c832ef059a1e942f667dc343f7f19c5
SHA1791e9db3a29493f26f0f04786ffe52df6b26f71a
SHA2563fa57ad050aceaa254913f555d94e116d894ab99bf8f5fa7dc501f2593dfaae3
SHA5122df2c3a4d50e2cd02e4d84d0d4c381c40e525367dc72b5e2d99bd30aeed5c5b135d3c5f6ef4d6e50b7c3b26438af5135e5f2ef428ce63b6fdbf44fe12f69cb1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543c95b412d099fc4c01b5fba6ed43eaa
SHA1bba1d89fa0e3870c3ea2a1987cdc8339a104d135
SHA2567eaaf4ede1c5a2a9f2c36a7e2bf8bfdd97900942e75c6fe121cee609c0e7aaf6
SHA512b9e6eb8897bdd80f485b561cc15a5672bd3d4403b605fb091d3521fbd033c71337194f1679c0400d854e18ed1b5164b3da1f3820525879b657db9d5d8e325200
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51155ff0c702da93fbe636ea7521f6b5d
SHA18fe7632dfa1398df89c4680ecd90b6fad3b3e401
SHA25672103fcb9fcb1078c9e81b26adbdbaecc4cc26ad6fa2fef3a7e24dd6283982ce
SHA512f419cbbb50318a72ab38fb128a7aaef14b6c1a90791d73347b057c84fb3e467015e6e411010592e0b4bea4ebc76985c5920c70292a14ee2e15dd36ba53f868e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51031ff01aba8032b4c037c43c04cd5cb
SHA1f19f4c892d641ca94560f735927918de3b0e0d1c
SHA256f64709fd9ac9d5d5fcfe35fa50a88e818a078c93ed337276f707218df71379a1
SHA51262ba6869f1988f515ca9047f66009ee4111d863a9d1124e4be5dd6b60aa3225e4e32f9c252d9458e4cf9dd96fc2bcd1c4e0b727a25768b0588aeadc98d3b69a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57021089ed13d8766e652c6d85391c134
SHA1dccf9efba7fbe3da4d0c63113f153613f29e0706
SHA256c7627381bb6941963658d205b60d38b22abfb090242abc6af3effec2561fd963
SHA5120f0209733e45ddb58045b88e5463932c8fe5bb77ea042ab06374f494ddd998736a27afdab87826cae5feb98a67843d1963a790a8a5cc4a632963fc4bd4a6e56e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce9674d033974aa3735ccb18d2ebab2a
SHA1e1d4420e3f507ff233520e099c875db12ae66891
SHA2562ae21f10a646f1b5d3acca90cc97a8556b0286f34381883b72850fd15a4d1e08
SHA51227636779f4b13222f46ec6547bcc9a0628a5ba8ca5fd247837f43337b70d1e23ccde4423478f6147cdbe820390a08bdd41f605db530f8b0ba990e230e05eda62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eeee28e6b6a02be71a6a58459185937
SHA14ac0412b87c0ec917c6e7727df6a58e338bcbedf
SHA25689300f0c9ba7f18fdcabce47176f6b4b0ce0e9f18cc974549c5d0169959f2bee
SHA5124518cf7441926e310efce56faffaa3893e12631f08f44652cd4927cd341c6d659ed28436dcf6f3a4fca00d67210ae9296c8193114d87911d92e4cbe97f059907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcc9c72f846628b0e32dd003d9a119fd
SHA1955c1b87120e5aae0554800bf6d11ee387a0c17a
SHA256ad8359256d5623a519d9f6dbc90c06c0eac3b96208bdcd7b2e24da39fb52b09b
SHA512ec7c6a2ea61261e58d2b82fa54fb167ca1db85243515b4a3eae0933356d4716ec7e27231e7d45a6efba1183c78678dddee9a909d8a0d13b528afd92523698bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a82bb8334e2b71360dfc63ed1ebfac4
SHA1bec7ff53145f44dc340606d6813ac20c9c7d875b
SHA2564558ab94ba3202f9d13c43cf09c521bd40e4437ba83b2f1ca5a303aa66366bec
SHA512b1c0bd09b4758220a6e391190adbd241ca7d4ecf7435dc54f8eb134edaf2c6e1343ea9a0e4924f6d63040adfe8cec2898457e51e22bdbb93c0ecdfedde7538a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0701a9cd9adc2c9fee781fed9e13801
SHA1b8f0435fd075285cbaee266c2af1dd2411928f18
SHA256a7e70ef71734c18a41259701f72bfe7e1dce386281ce4086948f97d68fc90fde
SHA5125937ca015b906e5426483bb6050bc4da106c0a656ebff7b041783701eb39739f0c619eb6125964b652204bf26b4225051e13549c8c51889c4b0ee7a97089c56a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5390723f2048768783976fb83f6b20144
SHA1d734a331d55276913f2eb1386d3abc0107b671ad
SHA256137c23a42b1ef58c07d330fda46e2e7e81946eb77c3c6ebc8fbf250b19fe4af2
SHA512e0ba20f037339ee57b4d8819a71df48754bf04a8df535f2604465be3f436601a01360865c95bf9156dd32cc730199171f7c89df0325bc05c3c5cb2b0beab4eb9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b