Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 05:46
Static task
static1
Behavioral task
behavioral1
Sample
406aa1f1a0ef000b5929baf464b4d443_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
406aa1f1a0ef000b5929baf464b4d443_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
406aa1f1a0ef000b5929baf464b4d443_JaffaCakes118.html
-
Size
7KB
-
MD5
406aa1f1a0ef000b5929baf464b4d443
-
SHA1
d1279d14a2e8b065d15c7fd8d8873997d8d94ac3
-
SHA256
1be152228c354331d9a4d8a260949546918c4ce23b15bcf486ac21d87381bfd3
-
SHA512
0dd977eeda1c223d68e3caf63cb2cf28f9509e657fe7c9102e06022225c385fdf139ef64c3d2e40ca32740d2fa1e9027559edb3733b0be0a7b12e53d79a59751
-
SSDEEP
96:uzVs+ux77nLLY1k9o84d12ef7CSTUHzfAWRKxcEZ7ru7f:csz77nAYS/txb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000931c60dc33a0a6a886e73f53bfbf51c55b329f936869d4b51c00af4b39ac6b68000000000e8000000002000020000000bd7ff950d48dc3674b18c2e10d764c5bc2b158aaa6135e395cbe00a4cd3a6eff200000005f7cc6273b691727fa3f0ee0526dd24bd5bc4f38750f0557d159d491e82a0543400000007b9b2e5e70e52e56b9a6b6f8b398a67129fd434b7571b0d3404e87cc8ae1205652ff1a656333a4fca74c4412a317ee8043c7743427babb071fdb4723da46b1ae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427011431" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30D873D1-40DB-11EF-B2FE-72D30ED4C808} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0235a07e8d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000006321b8b6a8e9e51181eb6f572631c164acd137d092b65c431c617476efef1c9c000000000e80000000020000200000006b2224ec07085e1a208816c71b0be0c289488cdeced4913ee40b335192866d14900000006f7677948c0f05badca050277b403ba086e5a619c08dcd6414e7a3a89c0737f39db22b2a037dcda65f503847a48e3923225cd1c5a6a447213159ba0491c7ff89d7a938a79102bc0bdb6a66beabec0feabd90453f195a83435cb9152ffc9b02ffa9eef027777a5a0e95e28bedaa9a963266dd49ca957ad6265aa8b81d66ce0714fbba7329473ba4f402bb6a303d883dae40000000ded0a45354a2011613ec1034148c69398f657ee1cc3218c698e1aca8a8ae749824285ac1ff3ed0eb0e3041acf3a499c238125a30ff5198f5b0608a91f712ef5f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2388 1740 iexplore.exe 30 PID 1740 wrote to memory of 2388 1740 iexplore.exe 30 PID 1740 wrote to memory of 2388 1740 iexplore.exe 30 PID 1740 wrote to memory of 2388 1740 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\406aa1f1a0ef000b5929baf464b4d443_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59b18b0a4f0b222dd8d6e9a2843298b43
SHA14a607984688bf4fed118c74d897586dafcadb553
SHA256cda2b194c4209779a4de85b07c18a60fab9b501b91b275b73096f5c9e8f3d489
SHA512b63094920f52b21dec1705223cecb66aa8cd7d256b919cb75b11434e79eaf9d9bcd05d3b0c9bfbf871872fa47307238594ab352df160f2aa9289a1d9d765b93b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52314d90963fa671b7dd5af9156114d94
SHA1dbeb443f3e58aa21137d63d3b8ae49e5a8475e29
SHA256e42ab980b54a7ad46afb4293dbc533ec014fe1e491fcbc29d83e09c55d025afd
SHA51265e358d8678190e50167c5439776689ff3c7c6fa1fb795ac0dd7ba03fc5ac85005f1658693b4cc3e11e70e01b54fdd994ebc75db02799dfe614e2c84c59c3ec0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b924ede095f08ecee2c5dc933b0bdacd
SHA1465678694abb5dc980c179b33a024d21abff8e58
SHA256d342826cead0f421efc94db9d933ef75f97b555dc899dca25deb662988e690bc
SHA512e9f14333af5e1416a7b6e6e34de0919f1b01727d214d385ea77fd7d0b070b8b274263910f375bab59f4267d60db05af88d3a82b17b931ebf32543b215ac2942d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5602a85610433638c10efa705f3afdce0
SHA1c4b26dc7bbf5b491909b92bb6e6176da0a98e99a
SHA2561c228a0c6fe100dd601c9879492d741d206e46e9ada0cde1083006abaec33016
SHA5126020c67d82fc5b8c52f247e9317436917e7314164e79e10d346b5c489de148e3160d2d77115f73507417ccac1442bc7dacb9962beda663b850e9e3fff8fe9624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59878813ccc83b32e0c13c08e3e162c60
SHA1dfffcd25ff6eed1ef5ac0cc0f54a8e7e6120f856
SHA256b38b03a3dcd78dc089295ee154a89ad14a9cc6efd0faeee89725413807dc76e3
SHA512ea0838cdfb3ac5d51179c73111325d7742eaa8b7e6106aba255e1247475fc57a8db4ce023ea3717c93cd3957f730e6d168e02d3145294f6dc0ddfa83e60e3bb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56d6b0fea9b4600ab5222f42d2eddaee4
SHA1b1ce92b4279d7592adb54f399e1c6fecf813ed53
SHA256d6755ef9f5630b20d5c9267e8688f9b54f5e20641b18d212926775d60eda761c
SHA512e8f16902de1f14ddb035f338546977270d1630ba3245178a98e7b2a0c81f6ee094a43ef9b4ab45c54adb495236739925eac9aba3565560ae2148299efd671c88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD520d0c47b2e0addde53a99766d495fea7
SHA1758f4a4bc291025d1e45784342af4b1ad584e0f2
SHA256a45642ff66da10ddfdbba020e1b10e5617060ca16c2e473b97eacc8a088460c3
SHA512039644cc053b65c5ed28dcc58d990c227483d274319abdc3460cf526d44ed3c60e8803b60faf2889a209ac272959af73374549aa124e5a43325de29b0f7d51d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5aec00ad22489f9d3a034ca923b235735
SHA1bc5de16c43facfd2e4c097706e5d2d02d9034975
SHA2561d7ff2c18d1c959d63374d122a77d832c85dda5b6606b1e2ab65a43ab04d1bde
SHA5126e464a034364065c483b1b9934e84ad21b1df0cc6cf4eabdee38f39f11135186c6aa136ddab2641640b85dd9c6e23e6f1741ff08fae325ae4a521d63ea60bcd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD502da3927cdc2cefbb1c506310fa1b885
SHA1113ba41f0524ae12fb0fba7e2460266988bb4dd9
SHA256a373a91751bb3ac28fe5bb8c40be559baf529f9c276ef8f63cf15152aa730bbc
SHA5125d58f21fdb4fb170cb567ca10b21d39c66828fe9c4793371f7a9bdf33cc8355ad5c9e8f192cc2b5fe80bd5bb4ebc67e4b3a4d7b06b44d33058a375301e2fde94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f7141510b48603c31452ee082168e41e
SHA1edeed51df3cac3a8ca647f4de3de24fb5c608ce1
SHA256ed7e9796aec96533cdb6b79e61e1aa1cbe52dc4848c07102b48549f27227a4dd
SHA512fb2c7770bb9dd33dfc85034b8a278a0061cfec82284a1c55d2661a8891557a818612de066566a34558e44e939c95c55d36f6bdf77b4e941d769196f0a2bbfa76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5defa2eb1c07fbf72b2a5cf222c38d7ee
SHA10b4d252050ffdc079a9af9ff6f793ee3fc5819e3
SHA2567a5e5bd036e6fe5c0dc3012e9432648d58da664fc4b06b9e1dbeccf1731fdfac
SHA5121f66765c906f3644a62f3c3fe8c9e1ce700734edf6bc37f8dd4cab906f0e36f7a3fce22d8179b633d26db6b462654f61ed9c44a86070f19171a4e8ff07d97242
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55c7d050a3ce88b32004ec08eec830bc5
SHA1c088d5a6ae9de69b4678e94cbd0a565cadd49579
SHA25676070a96e59b3c0a3674fbbf3450e151b3884b880289a0e538472922e03f2689
SHA5125e71f28331e8bfa6a19f02d1e889fc554ebc655f9645a8ebf5732e567ba821e180ea8292c1d3d97c29b3ac8d42e4eebc5ee5e8733072ae2d4d148fb9a4ce0f07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cebee43c023e2ae2b754fc96228d5da8
SHA1779f467b032057f29297ba48b04bb42622e04b2e
SHA256dfde9ac5053eadbf1ed523f3e2431eb3521c4610b70a6569726dfbc6805b0dea
SHA512d0429142ef56794566e2dbac53deec0113a55bdc268c094a3eec29e10d1a1409685de164c8d7e769d5a0f0ce4a45bfb186489640333baaf18c7a733d736abb07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD540c69bc7cc6f0c534cbfc675149b227d
SHA1deac5f5714270040f1301c9405935ef68770dd87
SHA25615a50f4482851a4d7f3c33a9002efb8921d6165bb38ba3f90db5ce1256059a7f
SHA512c32c567908f1f0cc10d223ba8258353ccb77db3ee0eb83c7d3b9338951620cf1fae7676c905d217112232fd43ceefe60fc31c128ceb2cd887ae2da9be81c2145
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55842909f34dccfb9c0123314e80fec91
SHA1a4b570097e47d3ec784422d5a4a8efc321ac85a0
SHA256ea8ea7534f1dcccb2a8972438d90934725fb8194dbf1c43056cce6885782ed5d
SHA5126ca0e2c96a59210e8bbfff449a164bc346d06c4450dfc42e780f42f77eef3bee48a8f9f01c9daa03e671dc53f99c62401bd3d446b551b059a7d2f5384673ab12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD593710b9fe338a5305d753ff65dc12edb
SHA18e0ca48b3d2255ad9841173878da689cd83032c5
SHA256f33b5cd1b29ce27efa3e9ba32e8ef1d3b231cd6887302c3a4267ad82cdfbf580
SHA5126ecd89712c55a27a982a42bd71b4cb78dd8162b716eba771a0ea552de7219a743fd9d1436cde1403f6b82a1ee1e6fdeb99a5cf30e6ebc0702c3994191df00ede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5927f392b20137bd5e4fddd85542bf1bd
SHA17a5ef176599ed7546eb6c2065e4dd4d9b2612dba
SHA2563ee37bab86e8ce44f81060fd8d94c9e09c44e05d5be1e4f99dabb25d2811af8c
SHA5122f2ce8ad3eaf36e24aaf36a06e8c91de3faa52dc61fe0df713c6f1d3563b2f8bc3e607fce19439c12c18f507706191785e4338958ae9b615cf9fac55a2073e41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD582a90a22c18b77f49a53bc870ddf4d70
SHA1619c6c739114618492deaf8eee02e70308d07adb
SHA256645c9f6c8d94f44e4feaf0faafc68d1ccb5213fb3adcf41271bf518d9c85db11
SHA512254e377c84659611793a4d5609ed04c682908b6110a2a48a2b99252747eb6c7221e478c4d381b29684e2936df73dce424868b569f66ef8a94d4623a55700eba8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c71c95aa18114a55ec5eebd51322eaf5
SHA1a314d0b6a9589787d6304fbb1a566155f3840471
SHA2569d141c2adaad4b0aa2056c614d08a46160ba8862a369a497e7b9a39f00ba2b78
SHA512b019673dd096cd7ec39357f77ff53323585504a1f41332535ac5f88c583048afe4bde8540356c9c0580c47b41c00096133ae7d8fd15f3cd32858f669aea439a3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b