Analysis
-
max time kernel
121s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-01-2024 03:19
Static task
static1
Behavioral task
behavioral1
Sample
3fc31d7f69e434452dc6e7ff247bdfcd.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3fc31d7f69e434452dc6e7ff247bdfcd.html
Resource
win10v2004-20231215-en
General
-
Target
3fc31d7f69e434452dc6e7ff247bdfcd.html
-
Size
3.5MB
-
MD5
3fc31d7f69e434452dc6e7ff247bdfcd
-
SHA1
518df2ddb591227cfd3be2e7df9fc3cfe03b82de
-
SHA256
268a45548998040de9087ef881b97062c9a576bb24af5e58fb4d66a39fd15c48
-
SHA512
b4f3d83c3e62bdc17c797a9c05b1c7645f7c0e8945343b2083a173421d18303a7b0a0e531677642dc871c7fe8dc5927eef630f9a31574ca957f0fb864f6fb437
-
SSDEEP
12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NA5:jvQjte4tT625
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006175fc3b55e160c579d11aa957f0ad16b77976783a41ceb87726e02c842d35f6000000000e800000000200002000000067dc347ef619644aecf5604ca8dd4056eb5544e8fd74b1efcc5df545ccda4dd52000000029d8aff5773ac7c565a2fd6cf27a3b5837473c63735e79a027354212e81cd1d64000000035aa15c55b0106301cb460e1aedd24bbddd21c00aa3a64826ca8f92f10665b353108e370d07cd30c82230c968c13cd431491a415c8dfa3af93232508130f5784 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300b110ebd3eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{295AE1E1-AAB0-11EE-A628-46FAA8558A22} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410500286" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000005e3f1bd544578eaf058d85a4cc9f4e81d4af12abd27bd1588596c66a16c0f077000000000e8000000002000020000000fc402ab6b8c9ce1eb9ff98cc81aad370e1b76760143b9195e5aecfe1215c517d90000000481e543bd99d4ba64a27596f8d0669bb767839777634ec2d2d06774d7a8511eb8919c40171f6e1e6844707773cc8300889c5ed31302f01d3680015dad5bc710a70160c6ea6da3e536ca2c6b5b71bd30452cd4c70de4676046e550b7a23bff04beff54299b3c8c10463ffc9f75ae98b8cc6eaff8d87199f4b71fc6e5365ab1403ae4180ea6b54b83db32903db4635cf0040000000ea3d29198fe00f858047219646e0bf0270565537f69959bcf3074b3f1e53a4b8fb6e0e8b406a8e8b1b9781c091fa13b54c9ecbd21fd42d42cf7cd900ac2774bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2424 iexplore.exe 2424 iexplore.exe 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2352 2424 iexplore.exe 28 PID 2424 wrote to memory of 2352 2424 iexplore.exe 28 PID 2424 wrote to memory of 2352 2424 iexplore.exe 28 PID 2424 wrote to memory of 2352 2424 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fc31d7f69e434452dc6e7ff247bdfcd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559da5ce84302f07fe756730613e4afff
SHA1ff01b35f700a8e2745ac106e9ca6b702cdd91555
SHA2567ba9115e1164465729d9d1284838cfa3041d8736ec38f2cc324ecb4d2e9af411
SHA5123a76ec0d0b2fe6ab2a46274ecc03d51f098dde92cbf340fba99f7933bd490f578520c1dcd33c67bac98852df5bfc609723e3886f6848d4db1d5b8431464695ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5f4b8e283f72bc799d9418de6e02b2a
SHA12a9a3cd8fcebbda95c2a642566965385e618b131
SHA256feeb1d31c5d956874917eb56f85fd91710f6e2f36d5170f98f449ac5ab33ad9f
SHA51205b0641a40042d5ff1a47dce424c0755f5cdb560a9b1211f3486fcf22ec461d7d3c427395bae7775796e1546777c06328aba7bd513946ef13992e42f4ba43097
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ad52455b15f99fe62b0353b0366cfcb
SHA14c2e8e14412ce5d7b918dfd625724be6a60f5695
SHA2568d8b36fd20cde18e7e71c40a5cfd91197d7c044a092668469fd3cbf4d4342cfd
SHA512737b48f7f082405129ec20094d07f0d6d5e136189547533793e47d424b6777b805cadc053d927f0f4d57b250ef58a23e4096d38360d98bbb4adc8b8a7da4e82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582df9eaf083759355955fa8454437cf1
SHA159a67a8f29900aa6e4c0c1da810510173060fc38
SHA256572d6bf94f674d3732ecfbbac59f2deec91bb76285b475dfc56bd5fbd245612f
SHA512d39eabad883ec0b1b615c3e9950d0d90a0f6239d6f9965f23a72d62aa62637c091223ab632f1d72cd492af08d07a58ffd4e1d2eedc711d32c1ea7ea98d5a2ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559846b3048512f9acfb1584b94036bd2
SHA1c735aab5adc05e4b06b826394e4ca5edcb9338a5
SHA256d2b0c036fe87e0e97c22fbb24a9043133c6065207c89b0768ddb1e2c6f8e91b9
SHA5128d874d9e3e9f7998cdd24a11c7f02cfe7838fb7b5f2ba8276485909f52e12e4499077d5982091e8e6ecfdbb370e0aaf60161acbd439f7816c8d145e1f93e334c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d25f1daf6d61157f62ce7e058bfb0a3
SHA1fe6f536854b14bb4a538c338522e7836359afb8d
SHA25626198647f4edc78eafbba9e7ba79aaaa3b842f4c422936fb28319f6e81ed2eb5
SHA512ee2993aa2d3c50720fec8a1a4a73dd526be1afd62fbfe42fca6419357126c983f50da1118dd2a3d3d7694a04b0cb55b65e3ab19f5e72b885e8467601c8ea754d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56155e8bb53ca47940432927e47509a80
SHA13e81e8782d4e607b37ac635079aa033bfad8dd93
SHA256da4bf6e0e2d7cbb7c66b32b9edb66b064f9533dc4e007ef54125116c7368b6b3
SHA51214676be1419adf08db5388c44e4ca7b91bf7a44b0ea16740962bba3e3a1955cb390d8b5abefa66a62b778efa370c1fcc3a6475fb83e72036afb9af5f20fe7493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5266ee438a1a85fe8854b3a052279af8b
SHA14e64a86d05e2ea6cd07451f9f1732db45a52e267
SHA25600c4a053052043bb806535ffa9c093f7e9f793dc291af53fe8b9fd8bbfe6559a
SHA512c0acc298d4c16958ed5efdd8f3680027e65d069d607a391327bc2f8d6dded6e62eeacca72de0595423adda4affc4859c5df354fbc07365adfa23b2dedaf7b45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57774e78e37035c26340f7521ec016e28
SHA155bd83036c75eef17fc10569257ad21446c4f597
SHA256a7004f82ea930ba95ce21b182de30dcc67bbd50972dc18f0066f7b681a777d86
SHA512fd4e0c8e84f40e46e7c89df15120f1544613b460f59e1fd3f28f2802887829804a91e248ba771fdea6b560fa7faa2436152b63c94a2c6005ef6f19c05d29ea5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb16e2ba9af274ad0085ace09dc34d8f
SHA103b9c35bd72ccd085797d96cc6e3a905c8a9da72
SHA2566eab025cce2037c905cb12991a374d23e2ee1993d572f4d00dec7cb03109104f
SHA512828e5154e9fe2beda607a4157662c104d23e0e4ef1b513aa775194f325a3fe03c52f4c27fc98d7a65a966385881e0bd1cb827e23eb3a0cf35b6f0ff12fbda2dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf465c009409778da716f63fc9855c86
SHA1dc4ea1b50be1de9015ebd854793b9da59080fe61
SHA2567272dd77ce5bf9d74a89ab2340320120c10a4dad4af4dd0634f3d1f7ef12a317
SHA5129fabf142e43efafdea637bb6eb9580a3d21aa75ce8a8b6ff3d24e7b91802999035f29f115371dc0b19476a8caa39d46043160e24131a34d6f94f4c8737747dc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc6e486d37aa779d000f5b60ed15634c
SHA128a336bcce21eea0ba76ba76ec9e046d0392f4dd
SHA256cf3b2d9be4fe81a5f0be87c4712ffe62d9cac1f102b6174e87c8906b52435199
SHA512cc65c78ebdfdfda8fa20297de72993d648f48e957c6edccc95e2bb54642db2609f8b35a038d95d6e9433bc3cf5ffabe58e98c6471f58e40f65c573761bd8f105
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b703b9f2a92f3b6eb1a0b55c052f603d
SHA145fe3343015075a615a19feb7672b91fe50c962f
SHA25676dd88e364eb2fd3aa390d6b23bf618eb9efe42b9d93f7c99d8fad738f90b2aa
SHA512ae3c719bc98ed1eb1858a830dc1f302a9568b048d92b45375387bddeddeec31914edc092fadc0eabd5d8dfee8596f94398223b0a4dead74d4f500f6d1305f91e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551a2c3ff183ad040436870ec3f9bcedf
SHA1a85c604835946f44a8e341aefeab87cb3bcaea81
SHA256f57c776668c41c600e3d2a744d92f508a8ab272b95fdcaf2f53596d10796af4f
SHA512a63c53832107a21fec53c6ae8c362693019be567c8c7de702a3db3c31df2ead5e2470226533ec4b0d97800e01d4e3ce0dcff2b6888760b8d237ec324c383a5c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52903c62dfd07ca9af5d021846288a237
SHA120b552966ab43652f490499b462bd34280f55ab3
SHA25606724dbeaa36503758ba7b833dedf56d11226c14b3870369d37a19ff372462c5
SHA512472ae5ccb65cc8c63d50cf51e30e1b4eeb3026dff986e18e6a746c5c314330612905e227de214ca917f989afd9c61ae9bbf8a71150c835a6e9d073029d0ed740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9644eb68d2e47364f173f9d530e3a64
SHA140ce5db4ea27e5f7013ebc25daff1224e45d72e2
SHA256d2f8878db7d6d5474e33073b295aaeb21aa04482fb2a7fba432b9ed6b53d78b9
SHA512a06201b98b541381b32e72351d0f251e0a09d03f6cfef5fac71c410e1bf87eab6e537b765b27be9e5adfaae9c51b7d745f0c2fb3c5f4f48e798bfb7632333664
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06