Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 23:03
Static task
static1
Behavioral task
behavioral1
Sample
2a181f4ffb1ef8492e857f0d3f03614a_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2a181f4ffb1ef8492e857f0d3f03614a_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2a181f4ffb1ef8492e857f0d3f03614a_JaffaCakes118.html
-
Size
8KB
-
MD5
2a181f4ffb1ef8492e857f0d3f03614a
-
SHA1
b947d30662ba7bef54d6fe9817981505d40d636d
-
SHA256
652698399b33a9b72647c840bc4d25f962e7563d493f17735a87f02e3dfd3c57
-
SHA512
9f7242f201ef129207c3967c58af398829f1e61b9447c66aa6426adf284d5288de34ba87c799931fb7c5ad99221ba9b7d531b295283bca957cb7d0042f51ebff
-
SSDEEP
96:uzVs+ux7KOLLY1k9o84d12ef7CSTUOzfSxG6MURT2/13pX4m6WHXCmCGq8k/lBcD:csz7KOAYS/ERTg5o3b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003cafaec7d0da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000071da15cf37394d3979876ece73a06a01556a6bdc51c46a11578665b156a31364000000000e8000000002000020000000b7d30ba44683c447a9b8e5d4cfa8114779fbd01befc5dbc856b2e73f491608a52000000089925c1767c02ece22713018c587c2e284d7a08196c4feeb851f636a71cf03bd4000000044cfa7917f1a45d0083c7a6f8550f726c20ea2e854c4dc58a21110a4b9795231c416254cc15a346b5b079482e71204e06ef6401f7124b359955f7991ea3998aa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426557736" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000083630e9447dcfb35f41a085a85d0839409e3e4ef3483660e8dce3b40d14555fe000000000e8000000002000020000000f7b5c1442c387cc8358c8de6c8cd8b73c0fb5a83d3014379444dabdbbf72a99c9000000057538c3d5c4776c66a0b5d4c3df822984ecf14b1ce78d1db763e45a48ce0873dc5cb8405b9c7b0a807517e7fc49ca443dcc51f66c3220b31f58c3b3c5f97236a8584c5563a22fde0f614446943b882e71373d21f26470e2a00db13d3294dfcec9087ab9480319bd99719360694a0dd16bf70cf7b868ad7bd9ac343ca7fba88e79817bffe2cc7fd00101f49109f952e92400000005946690b338df2702009696281500dd7873673035938ba999091c7eaca7a9243a7fe35924fbb4282490829d9423aa0b41310a48d740281e64d236c018548483a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9A4D281-3CBA-11EF-85EE-5AE8573B0ABD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1480 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1480 iexplore.exe 1480 iexplore.exe 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE 2816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1480 wrote to memory of 2816 1480 iexplore.exe 30 PID 1480 wrote to memory of 2816 1480 iexplore.exe 30 PID 1480 wrote to memory of 2816 1480 iexplore.exe 30 PID 1480 wrote to memory of 2816 1480 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a181f4ffb1ef8492e857f0d3f03614a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51231660266111220a9c08c58f359f51d
SHA152508790dfb9ed70d202b77215df776b1192ccbe
SHA256454a700f066cf491f420fe49e28f81b30f31f86098f76d5cb7290dad09faa81a
SHA512d0144052ae4cae23f37d53fe672d9815f4b32a92e6b16fb4ce1ee5ab4b4ed9925568a11719884a2c1bf7912e3a7870afa944a03e115fc8bd70ea746d5d8f4cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c7e8965ab5d14322c77f8ca14c1f8aa
SHA1604939d6d0df93cb9393a597d83c5e242faefb51
SHA2562b9ee5775e238bf2c2ccca15ad53aeaf00178fd0e4256c4e4648d7cdafcd50d5
SHA5128e3d9b7adc46e39ad08b1d02607173ab43bfaf0c0e11aad770355f8414c98ae9c08d23d3acb1fedef5c2f96af907ffd3d217699a17368ac982d84beb14fd6fcd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b12dab33cae305608eabc0fbe54d3ef8
SHA1271f965d016d297c9b735b4cbb9207bf2424b676
SHA2567e85d2db47199d549fb41b33eb19ea1908386a42615ff351be0e3b8e86a09040
SHA51209cd4395cc76c9d3e5f384e7c1b48f82cf8e84aeeb4b9a600abea1b966fcf5a0adf2662dda46c0c468449c09b56313c06ce5efe4a2cc2fb52d6d61cbcfc4bf29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58106f625813ee91f618078fde81a6541
SHA19f3127e62e6a303ac1d6f451b385803ffdefa134
SHA256ac338ac32c2aeb734775c95be613025878085191498560a48459bfc5ae13a9f0
SHA51266656c66ef496339fb2d4c99f3c413d2bf0c5790b75a50813ad659998e986792b85ee1cf309ce6ce807fd84fdb599b7a05a5ad6f4b4b399fdc487f1e949624c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5479cccbf408d53425e1b7534264be786
SHA1f3ab81e1bccb487f0ebacc8cfe285f74fd2929cf
SHA256416b0d7a43fdea235778fa4c61c1906031bb9e16dc8af26b2e2b647157720918
SHA51265b21d66f5bc9472156cc2e1b1e838858b50924893dbc3c73a8b70d06748e13cad0914004cf30ffe921f94410208f0826302a6d5f6b77f35db1cec191ca0e381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c9100339f017b5dcf461f3485506458
SHA1aedbb3cb27f93ef2a5874c6c6565fe45ddd75b43
SHA2566071778d5e7549605ddc666eab00c9c768a789392b69b15227462704d8ec674b
SHA512947a550f8cfcad7f90d1da3c485f0c793b56b0d11a206b4445f1f219e1a272588641fed152b2db1c781725ea38d36f96faac18b4bb1b4d5d127ad70406719e4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f5dacb9629734fa2edcc14d9660ed9f
SHA134c9a6d050d816105d99989514b6d2edbbf99891
SHA2563ebba823d85c09f1f77777b3a9aea0c5fbe4f068fdf400a44f90e2d46abbf717
SHA512c2e158fd1703b480f22f1d31c3947108440a07e7acb439ab92807a0a6e22e31cbded6d1b12c4b70d43bfafcf0e36b5daa758a74c7b863dbc816fc27764edf0c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599ec7ae00319bc484f34ad44249056e0
SHA16e76ae0f9d7cb2c286eed73559262e4b079b5629
SHA256080ea85f7cd8ca68d8a3c0f642273bdaa9ffc7b37a144a6d244e3f46aff522c8
SHA512d1da131a9912f10146f6ff728c281dba4530f1f11a96449560370e7fa7ee2c2449026b5993bac7b5d1b16f8cec79522dbd20c3d5e1d6962644b5624358e9bd0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59aeeaa37017dbaeecad1c5cb419a411c
SHA18b3102ff1bccf0a9a944627b92115bc88e1ef679
SHA256b222875de11a022f03197e9a557a3c0fdf1690e6d8a48d8f322de1ceed509a49
SHA512d0c9910092469b22d785430a9a6c9e19a729d37ecd1930ace9432b5fba59fc2dadd83de1eff7f4252497601cc78ca1206f7317ced76f5a8a8d47ccdbc320e851
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfaf85298951513d1a44a1e3649a02fe
SHA16fec89c1f20de8dcffbed170f1af19b612a35c13
SHA256ef50e94d04c249354177ab5aea42a73876bf6c85f432a072b0f7cc2f48783050
SHA512172004bfcc42a2c1c131b7024c5f3157b7e0114b30c05b54da2202299d89ebfcf366a42234953e4126134b5ab953591804a0dff34a2a20d1bd468393de801d28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c4a23ece6d069ff4204f7bf71dc85d7
SHA1493d080f121941aca202ebb5076457312e38961d
SHA256b1fd105b82edae1b6d0c2f7ccc7aeba4a7eaf8a696de5fd7e58ef3db312f202a
SHA512e6f65389d0c9471305a5ebb41cc5c5818ada2a996275ac4d543d899a288bac15dfc929109baefbfdfef1d34f3baa0f2c86325ed941ebf1d4725236a9bc566c09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59aa6ed167c47f8886fcbc0893f0bb385
SHA17d19d6d451c9112abdd1b707e77407ed82aa91ee
SHA256f500d5e01fb00125018d1e4cfeb7e32bd4d0ccd72d82299f44d320711b593a25
SHA512dfa9e0ad88403aaf83c5b30a8007fe6d3451a0d61f19ab829c7e502c1736cd67796af1763da06647b19ff55b3f6679a55189414bb8efb78728f1e1e37ae27f54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD501af65738ec3b5982a5b26c1e3d70d4c
SHA1613890f191ddb17aa499f1cbdc8b862ef01d0870
SHA256e8a1f6daf87738eafea6c94605ad4c28189fe159e9573f612ac578496b71c26a
SHA512efad3041a092d40afd17e5dcc90aa4d9050c08da455248ff5fa027c2b2858c44aef6aa4177f4bdf4b741a36ce77a264a8eb0e801c94aef288d011e8967bf0992
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5620d547237cbc2513919d03e7d5ec080
SHA1a152243b1c1e9e5ff95bebfc72f8b39573af8245
SHA256db9e094b276806d84520f3774ce74b875d3b77be2ef7e5526103c3a110ea13d9
SHA512de2dee15c07c0918a89bca35d786c9e3d3755fe8ca6851bb7aacc181f3fa4ae3e68e264c9d1eed38a3119279a2d4045514673a67cea7c8d9098677274b40a34e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0f0b4335f70bcae4a1b0f26421b169c
SHA18db3a8f4163f9fd5e26c9ba637de0baac5028861
SHA256cc6e5472655ca0183ae90d144e51a0578a3de350397dd7a5bae91594a3a10390
SHA5121904ad6d8259c9b6a573e09534a37897a1a9db58190152725ca15f626028cb1cbb54da35c34512c75d4e24e1f75cbe4f83d54cd4e950a748a1bd9c2377f3b575
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567722a43ecb5191d1a30222b5cc4de97
SHA1e87a464edc88f4c933ce3b6fe846e151d57c081c
SHA256538cfa6d40b00ac468a1edf83976668f9bbf2d922b97e2f6d370d7f120d834a8
SHA512d7ae8b570e1ad8e1f6117212ef13fa054503c5033a0ec37fd71ba3e979dd9dbae119d9753877ee3ee10f043ffedf215cb56f86674e49ca434bb7f7814279e316
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b719d32f8a6bfd805ac8862459e227a8
SHA1f403871b621aa064d999d2e1654b5898ddf51cb0
SHA25640924f6f3044133676d093d26d56712558d4c46bd3d6ea97e62d5d7a0ec2d4d7
SHA512498071b0098bb46344000040616504a6ea82b7a415b359c98f6f3aef937f8b0018f0a028d9f8305804dfa0048200a722ea712bf978c20309c413caadb7287d88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526381fc141c602aab4072b5c47512d82
SHA1b5ab338cffc23469456713e3bc3a425a43885e0a
SHA25632e1d17e92f5131c901c7e4264acd09752dca395b61eef92c101b3355506767a
SHA5124fc00aa6bf2b4328576d9d33190f4969496fac9f9d297fca58ee81d7088d1dc8fd9bb089d4a0ea119845fe324ae633bd8330737136f96658a850aef0a218b54f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57d44fe6c986f740a5663adaf8a212955
SHA114e6df9b641b60b52efcaa395d8705dda7697798
SHA256620562050236a3936e1d52cf9d7912cc0882e1b4068933b425e1f3f87f856189
SHA5126ef208eb3d4d4f68044b6f9d9e2d2376e109fc850e936b3ea23b8e873491f26f14fca3fb13024f143a3d40f32ed8ea227b7346b58de9e9be865b854e78f2dadc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b