Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
367a5848ad572e5c853e01901dfe011a_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
367a5848ad572e5c853e01901dfe011a_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
367a5848ad572e5c853e01901dfe011a_JaffaCakes118.html
-
Size
57KB
-
MD5
367a5848ad572e5c853e01901dfe011a
-
SHA1
b422db4f7286d905c44ca4a4fee193838abda56a
-
SHA256
1bfe98a8442184190c17e2ba31d96d614fed9228ea4b2daa591c172386df5ebb
-
SHA512
7bcb060781d7a22da25b519f71117bd165c24c7b981b7c59baec0eed3ec85ff428057dfa73a4efc16e66523310af032f1ad9145cf8295c882f73ece10b1a9288
-
SSDEEP
1536:gQZBCCOdX0IxCP7Puf9fvfOfjfNfyfbf3f8fnf+fbfsfYfzf1fzfSfCRfbfJfOfj:gk210Ixt1nWrVqzvk/2zUw7dr6kThGXb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000000eda311b9479d151b79f47211b88a7333c47de2aa0bfe36a2b7347134b49ab46000000000e80000000020000200000004d7d1da0b9c8f13d758a3dcaaacb6e3be4f47a65937be2e05c66c17e390777bf20000000794cf97368d7de83141c406383c356766aaab4dbfe2ff01bd09406ecc9ee957640000000af2de2a7abc74959294021a2897c9151c12e6228b973447c9681bcf40e94f7710757ba7134836f0a86a753e7f96830368f34c6222253426ef8a430bd36dea863 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000193d65e968b7f1249ab5003d85f493bf45541f12faea26ed543bc15ed7b494fe000000000e8000000002000020000000e05d36c04505b64f825db85ea10e455d085a64fe5deca679c7bbcd3fba79020090000000de680fdc4a54901845a1257b12d7a586ab80976d47a4233b45ef42511e3eacbb4de9b6a35c98219153729da2fe3b49aa5ef11032c782c5b5524c4597b60ad7eae7cc3b3f0fc150ba25670e997931c72d0913cfa3e6f0205db35b631a9d20d28518db5aa7aa524e2686d13105cdba5cc1e41b09a104da8052d13e43adcad0c8bd42ca54c86c4e12ea25541fe5edb98d5c400000008bb277db31468fc9ee4b76fcd371894386197ba994f0d49dbfb466ca2f23026e30b5ed17e63c28e4feb20c6246532fdfb71ab395398ba2925fdcefe5c751cddb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03c790411d3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426809132" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D3D6C91-3F04-11EF-8334-424588269AE0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2968 iexplore.exe 2968 iexplore.exe 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2968 wrote to memory of 1972 2968 iexplore.exe 30 PID 2968 wrote to memory of 1972 2968 iexplore.exe 30 PID 2968 wrote to memory of 1972 2968 iexplore.exe 30 PID 2968 wrote to memory of 1972 2968 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\367a5848ad572e5c853e01901dfe011a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5185268a4df6bdfb1e56fea6eaf16a6be
SHA1605dbd68651d43a3aecb617a88c0ea34fe985a25
SHA2563d09693ef1414a9e3ad9b44560ad960c5b754639f6ca30306aca04e84b81e487
SHA512efc7d6bc217522c9701a7a0470adac797c3b277f28aff8a57a5e092437d23bfecb7baabdf8927885bd7676115b6af55c3aa19fc7ca5bca473ac81e677468ffd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dfca6b38c53f817516a39dcca442b1b
SHA1090e90c36739d069b991d5d4f2beac8cdcaa985e
SHA256ce2999db58be7e50630a087cdd6e65a48dc8a6cb63f592739e4e46519fa8b2d2
SHA512b44897c7bb48defd0093f118828bcbca74e531efd733a24c915dbc537309fb45a9e17c9c07a78d2fc86bed5733cb5049733357048466a856fdd9bd6474913285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56faf1f2cd1abb074c86ca9b4df7063a2
SHA186850db6fd084058f101428e4948a9d52ce5d950
SHA25614484077428a053d1dfe71a73bbb8119fd2f6e0ac58fdcba76a4bf0f5127fd76
SHA512cabdfbfbb75500c1f3636bac29a9af13496f618d1880d8fe1c2d005a6607b27e303ac94413b9e5c1f7caee2aa4a5b08c6d465901fd79632c33e8eb0985dd0142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a817f1653e668cadbe9f4d91e2f64d06
SHA18acbf07cd5bc25c89c6b760f0b45bfb42f099f79
SHA256c26c714dc08f6570e11b8b51a83888c34925442b8b4321727799432c82e90299
SHA512bceae0bc29e1d9c019ccb2349da7e475dc7b4350e8b5c9d9c00a7183e7400859a6033d5e7a7f51a14c87ed383361644520969751c70c6d191212bb54417305ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a32ba4238663cc6c109a78413b5e0748
SHA1e404b9b66940315909d39573ca08174c73d2e508
SHA256aa2c9ed5b90e447ec6f6e65c06f94d464711e25d2eae954889b5d7f58b646104
SHA5128de871e7937f99d2aceb7f88ed51d435295b68bc0f78cc60ad80d62a3929d827e0de64b047d1d3bc5f5c9ea552effeef85890effdd7410de2d1342803fb124ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5808d7decd1ef6fa66dc38a9be9a05104
SHA171bf58b0a855471c5382d5a6daef16e5a85868c9
SHA256777e40fb8d5428d86f68636ea476dc67c5c07258be3bf7d385754e24e2c2a041
SHA512a85e7016aa296aa3f4098c21859bc0f09dc75e0e1d6a4479589aca2b400187412b254c480e9d35b074d92e582c1428b4961b51aef8df612dd591bed9f5bbaec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570fed8870f01fac702fad1dd07dfc4f1
SHA13a7902f5e1813a9d011fcfb6020b8cf4ded3cd8b
SHA256484687e8e06877219067f1d32e8d492c9e3e5b12ca473a827c8a78774e122306
SHA512ed3a7d990f8219fb4212328f7ddf520939e6f9d9543ac2b4cf18cb81cddffa05c5dbbcedc79180750647ec8100b10786dbe58e47bb36df6aea0ae74841317b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc6d5f82699c0a27105144f7bc71c565
SHA150b715ff472fb9b6be78d33ed2b8ff97bbfba0e1
SHA256921d9a061d76c53abb1ef081ad5c4695fcf9b0997630b97c5a66522c136307d1
SHA512b22bc6897f76f83a581ab4301a50745c60bac356abb12c14f04063ee2cd3a381c6300761c45d5bbae00e49627c41adc2a4cfaf3fda4ab1fad689631df53ddc99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532aca9ff58ec36a511bf4084d1cd70fe
SHA181f637a857bce1c76c06c2ba23501a1e4949fdb5
SHA256dc65de22e5cb85be818b45d0444dbfb5644a1f9722b07ed8478c5e1533c8b1b4
SHA5123ec99b662db08bf124448c56b7fec298a642bd85d6cb0965febc45497667d020267a1abf89492ca804944fbeb6d5080545f349a335936c9b92db9652a2a0c076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53c6e7998535220d2797b0655de4dfe4e
SHA11ea9630bc795ab5981a1b02f3574381fe5b4089f
SHA256b9562633995bfad74bd6fe4592cf00cdb37e9d342de46ac86208e8f7a1132625
SHA51259f772e7e4116c1f51fbc80ab58dd2381e1f3df346e2798f663a9ce7ff4e5a97d4e6eca6212d519e77792f2a17e2a688b03985f89002d7172730c0b2b9496804
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cb0bf06c2afac0b64c372d326083d9c
SHA1adda651cf0134e9b4c0a997061e542d5edb5ade2
SHA25650a69a9dcb5a38f2cf52855f141ef71d1edb6903a1a7e450fa8619d83c03fd49
SHA51259ac9b42a3ce632af854ca630494f63e1c118c2a1f337e98b7d07f2dbf9bae3d838797ce019ea5a0bd5c3787411907b968b2c9004f7ca01c7c84a6cfe1c04797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d862a3cf8cc5af3c66d79285877c5a3a
SHA16e1ce95a25c17c8a8c2b04d9779b430a12931aec
SHA256401e89162146515c7e111ab155f5f4b69aefdc6cb944e07930514442c383a354
SHA51202da57abee2163c4bba61f9a748085e24063f34e0942131822a1bba7ba7d55b328dbef4b6e67f7cf01d2bf04dfb6e4e45457435bd429880534e5066afcfb2930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564fe509d6f9c74aa386b44b68f20fb76
SHA1c93db5bdbc451d20afef30ffede5ee640d024c8b
SHA256fd7972d614d614efe2143d58a383e714cd4662e7e84ed01df97ba672c867c770
SHA512f93644bcd650cc943ac0ecb1001b5ebab61117a6edd92ca94a502b937aae453fbbec35daf7b6d6156ef492bd03b84ffe64f6b29df83dfd2aac5f9e297f6f6dd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f00a6dd27371d9f9a004289da70aa2f
SHA12fe60bd4442cbf4ac92af97c7b46c4ff51c8d379
SHA256fceaf05991561c652832ad326dcc75f3dd322c7d4b7fba5718bf03afc37e2216
SHA512bfa967b87524f85cc825cef34d5404ee5c2302a0021246318c9775612187beef7bee7723e142cae48036458304047863f6b3c741158aad5786cdc3ae92ebcaf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3b27e33f5ca72b52fa3d9820b1e28c5
SHA1ffcdfbf74838387a18c3c41f28d2cbb2d795987f
SHA2561b0a5a1b00250bfaf36e94643f44bae3d5ecd1b9d469c3471edc95528b3529ce
SHA512b0ae1e05d04be44309346e1b5eb8a7f387b555b8ff4058d11a4d8d2a3017ee33ef11994250a146e25a5e1e731d58d7c96580b376ecc7e2d5d14b77a08f758a70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2753bacc8265465fd557706cacf305a
SHA16da4b18fa16c0956ca548df9ef2ce2321ffdd577
SHA25676d5f6d8f2d5bcf065940afb836af89af6613fb609820ef8fa83496b6e9cd318
SHA51245bcf2f1d34cfb97cdab8e0a8641b46669ab5d989b15a53a8a4e7a773ff734f1d671e3262450bc9a80205e6d75e260780381706c14dd6ca4aea0557ea38c7270
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aec1cea0f706a96a301f4809e43763ae
SHA17204b4ce810b63dcf84a71e27a3202198839f62c
SHA256c3cb3923edade71f77b753d04b6832458bc41ef886c780e16503e6a587477013
SHA512b654bb908d46ae6cd186847db46d409d764b45da514d12a0fa58944ed8039a4ce2e99afa8161b94573ff9520af92b2ec6cd8afbc5f3fb98aacb3e623b216a70f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555eee16db73adcd41cfb48322abf59ca
SHA15e5168d3430223dc208b2fb8ccf813c51805ca92
SHA256c3260eeef698ccc1c0c1080eb093c80ab04874c7fc9338b1602f212ebd863040
SHA5123608b49710c56325381663b81305da049357bbf9a6725044637f6ce09e50ddfe581ed780003757f030e91b9078571553cb2d9db87d0fe1a93b75b9dd78dae5f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD597760daac055e457ce5c0984354b8dde
SHA1e516e46675530cf13250fc9d4975f74e70d52046
SHA25619af4d28bfa966d0fc0b4c238164b11298bd23de23c32b83df2c1145eb099715
SHA51254a51e63508334ff68371c0433cb227fe6c42e5d51765125dd0b0d9194a2cc9ad571442d2d45076a05ac4d4a2853557e7ef21baf5c43cdb366200564f0269131
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b