Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 17:47
Static task
static1
Behavioral task
behavioral1
Sample
77fc825bcde1d57ea6e67620ef8eb27e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
77fc825bcde1d57ea6e67620ef8eb27e.html
Resource
win10v2004-20231222-en
General
-
Target
77fc825bcde1d57ea6e67620ef8eb27e.html
-
Size
8KB
-
MD5
77fc825bcde1d57ea6e67620ef8eb27e
-
SHA1
217fc46df5a62c916934255cc60f2c6b3ad5df80
-
SHA256
ec5a75802621cd3be5ebcab812b30cedf29facfca67889205a825074b9b1e4a4
-
SHA512
5172e4777b44eddc59ab83b776617ae7c3e3ea79488f1f222b0b27476d09b1254b1625d1d3622a84e3f3d0ca39c3e2f977a1e0700458e4e7b84ab7133753f6f9
-
SSDEEP
192:OonvEt9DM1iMiZl61kjCXMCOwJOGiwnUOw4Su:Oonv+/jCXHvh
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000190d4ed6e1636443d11d860f8184e6757e5c79ff3dfe66c041ee6c5c41144412000000000e8000000002000020000000bc8f96489748d4ab9276d47508fd89733e6ce1e7dd64fd85ca41af4c2cafcf3b20000000da9409407a8daf9940d21149a6f47f5c4821a520c53bc37388260d8853b142e04000000050fcc768b30499f733629bb0ef6ce4145e09733cace40aa15d84bfa7bd5a622850395b1c2e7e09f317d979bbf344d2b26c24d19dcdc2bcac45d30d2a4bb7ee7e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EFF15401-BC72-11EE-9E34-CE9B5D0C5DE4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000001c44905081ac981657ea93c7ddfedd5060df1ae9d0804db83a6b88de2d2f8044000000000e80000000020000200000007c1e59298d57038f5decbf1f12c7afa1f3dcf90a5996c50d528c3a8dd6928ec39000000055f5060c110dbe2c211b984d12587e3a1a27fc8a2c7b2043742c1bffc259f800bab494c64c44bedb156f9e72c119fd5771884887892068e180c5e5325a7e38dbbdfaed2c994c45657ca4a110f2f62eb3a811ae527705d61641a9e7c10e711c046f00d49979ea43fee028eb1cf570216a9cf5b981ce4cd29f677dc6106a3945bd17db9fb5da50fb8342c208f5069252fd400000004e580fe00368f5d38994189da8cd93b88ee1b0e2b19b078ae4f6c3341e173d4b4bee0a3cd95e32bae85008e8363ce914cbc3f167c2e7f407828144be2bb662ee iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70afe2c47f50da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412453100" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2148 iexplore.exe 2148 iexplore.exe 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1816 2148 iexplore.exe 14 PID 2148 wrote to memory of 1816 2148 iexplore.exe 14 PID 2148 wrote to memory of 1816 2148 iexplore.exe 14 PID 2148 wrote to memory of 1816 2148 iexplore.exe 14
Processes
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1816
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77fc825bcde1d57ea6e67620ef8eb27e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500d019f8c217d85f43d66ac1bbe90a01
SHA1662982d1791d4bc5d0b9b5b50b83230bfcf7677d
SHA25639dfb3f78d169c396b0a2d85f5db346dd89bf7d3c21b2f01c1421eb0b1f636b6
SHA512033aa1ebe70e1702cfc66cba2112fd782f8e77048ae59b86f980e23143d3e070128015a23ff80cea46828d25c4e297146250d8df50c8fc9fd862e452137898f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5980507fdf1f03cec26313f2fef394289
SHA19208be8bf5d8cf772c16b8c1c4cffbb1f1105bb6
SHA2560cdc0a0a8834e1295df9e54c04ca6ba34debd3de850ab1514ebca692331def76
SHA5122c65da91bfc741efcf15ea7d3d70fc8b174d89c3fce4354fb340dff6f594ae4e6585a18daea7a8a2030f7a50dbcb71a1d8fa225dbaecd090088bac6b1a8473e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587ca272afa8fa57294c6347a2efa93f9
SHA1310ad6497a8237c58a6755b7a002934baf7497f0
SHA256b6aaaffb5b230196a23ed1a56fb845eb992fad6673f99e71a6014f00e4b0ecba
SHA512bbb367b195fea99bad41dc74657a91d4c4d59a5c20b58468a20c725c8b38f3046d8fa891c7b11b6f91676c9bda4f04f0fcda415f31c6f7ad21d9a3223821e42c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b898c4f84ce13fb5a6b79257c3d81d1
SHA1bc7f9c865ed8b5483164b64ced5f45f56b28f096
SHA256149a1ec66b64c1eadd8dde4453be01ccca1a3c2220f5e4ba832a700d30aa7e89
SHA512129da3eb50a072b4428e98543cff8809d08a18bbe5e6582b40634793035c0074a0b03f7f85397558603449a525d16df2411ef731b109df91235c01447f8a7e95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5139896b10c2482a41c9de3e4fcee5038
SHA15193caf6d9a5b8a4bbb82a9ebf44ae78953ad13f
SHA2567d61ac815b848ad5704cf7d0a35ebc3203ddf7bf76c83be66362c5e7685145d0
SHA512aace2f5734a34a36ebf1429ad2978cafa21aa5c3c137dae029d53ffc9858ebb35784a5c89139603c0bf36307f645a5f0f2a8e44fad993d4993b600282b7eca27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aebe5bbef6fe64b9291ba9deac7e6e3e
SHA17069c33d365ef88523ce20308ca65467c0af6a93
SHA2567d665b91fdc77b2d7f7583d65aee0a437874034eab5cf87d26a08397209dfe01
SHA512665d462cd8283ad8a71bbd8c60af4c0bbafa7d19280ee13edd917862c7b31612c9c3f149b3799a0b056a24b93da40f04049ecda05db331d071bffd3883f4b18e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e46f824eb1ae0fc3ef466ba13df9884
SHA1dad2418cd0e626c63385dd557b71b1f2b5cdb112
SHA25674e21d269fc1de1993b60847a3a8a0bad28d338d20a0766dadad32e35152dcdd
SHA51207b3326e3492af335716ba2da2d0a14556ce9058af7bd01db59394a5851f178613a80887398437b1d66216f93c6505fdbc90ed2f6c6a415a3cebe7f13e96f079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566836443b60bf92c8a46ee846e90ceb6
SHA1d42a14f018f0296d0647c39d7f83760bf9da0047
SHA256e1413563de332002c2a8ec8548844c3305add38df2ba46e744f92805b1782ebf
SHA512893e7335364e0128a8f58785ffdb812dc155402dcbcb2a018a908e5ff12a66d24ac8688ab670d7a9d5983ddad9942aaaccc2e50925eac802d3b0ff9de899b7b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572ef48b6a8f33ff021e46feebe547c0f
SHA14a6745b2a178e8f86faa45328ae415891d92b823
SHA256a26ea47c36363e89368d0932bc0739d4c80eb936a857a4e1aec9f9c1b2946f1c
SHA5124c23724e7ce525ceb652c96d8661acadab0c973eebaf50ab47ffb88f8ff77a9525d93ac157fc00d2bdd6dd748643537e5a756234b2242e8d213759e17f3fe3ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9037cb30b5a23a62c00371e014c9659
SHA134723758e583271cec2d9f3adde6752bf078e8ba
SHA2564b5fc57cc3c56ee8c8e4695a73983c833a1e8b3c8ff3e26fcc19c5e6c21ff1ec
SHA51297ee7380dd5c688bcec9623dfdea75b8a9435e4d45c337c776d829b0798b9656a4afb91cb1de5f6b545825ab5d770b9b8e7ac4273ba3af6fc6e7e5f3f4c2d888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529f2d4917244fe261a9610d8bbe74c0a
SHA18761c1d62aeaf4fa43fa7fa48b50b548dd1fcab3
SHA256d4c3e7a3f4368f2ad439a261fa19b1cd97dae83622878d064403f35c782b1fb4
SHA512c54179e535938db6a0dc9ce046b5e1fe73cb37b6534ab71b655df1c7e357d04273fc7d138a81a2d4f04e956ceac0a70439617be1971238787177e7c83da5e128
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff97407332b5eb6244522202577a378c
SHA11d6461cb90f19ad3baba5c308a5406e5647faf7b
SHA256e85eeb0ebf288464f85997cfec153e14f1f73bb11e075964faf324138b35e033
SHA5121d1176ea8389d09879dd546dda239f6a47383b119eda2f6d0a62ea68b6370e7ed7e37314596f301267c5b28a211073f63c08a908a935e64be0cb5cbe7a80b86c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ee5a5a1bdc6b878b73275c8a3ab2243
SHA15ac84a4ea1ac3651f1b1c85e9aaa3a40be93299a
SHA2566184cb42b655ef9cec74cb738daf802ad1437ce69c39b346791865806ac89b1e
SHA512ac595167fa9281fed0054681a8e8e4f7d198338800c99a442609850fa2ea14a8501a096a9f10156abbc5ab49656c4ec3e22f779b56620b0ef777012282410267
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f7efb3a494d26e001019448ccb969e3
SHA1efd2821cef612fe12efd653ac4a089f3d8156538
SHA25629211b2378519b18881999a4864c4dac322ce514420b747829970dafed68677f
SHA5122a5955a8619316947bbb7bbdacde70f86b64aa62f1e5f8550e90c8cc8ea3fecc11539ae8c627f10a2915e731bd203624c1bcc8a6cc0c125e9f2f293abec3266d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53eeb9431772ac2d6c0ad1ff6e955006a
SHA1ae557b9a96bf4fd4157337dc12c127e1050bda83
SHA25671ea4624fc6d5b81ca8c741f9a2f7e31c101f737c6886dc4c433f3b56864f0b9
SHA5128c90f04fe82acfd6fac3f083979a7f35a00b04a8202666d2fbe2b88041ace16c3b56ff49820e0bd8f15196f60fb690168096f102fb50304cf79b66b5a97e1adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557d12c580991aab0340df885d94d2d25
SHA1878c8ae1bd601e801021fc61ca8747567f63405e
SHA256a1adbc8c389db6db9ce422b96fb9e2f655d137b3a7aefb6636b39fecf69fc0a7
SHA512eed4c2be63d67c683e0bc0cce3b0f6e75a60bb70907f27da7192d072f2f8e5703bcd51b0c432ffea7062c7a6d8c108a4d8bb77b60189ace37e8f13c0df71a7e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577507a95e0caa92f3bd4c85dba7d4028
SHA13af95c8e8e5cd0829f74518c993619c94a06d690
SHA256a65bbf6b7821a8b6c455128352a50fffe30709c7927cb43a030fedf9a1e62365
SHA512750720a04c2fc8e4d7ef9520d84f8a2ef45e81f4e8bac708515024dc1cc00894d7a57082dc08a87c2e739c9daa2c97379063cbebbd7f63f508424f459978ab01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a56262d438f69143d5fb173cb2c07b3b
SHA1362efd7508f27ed82fb0883ca655705a06b2bd45
SHA256dab81ac9dbd8181b39901e4a78e3f3a267ec0da6aaa0294ced6396efe89ee347
SHA512477789365b4e07a7d6bb262c98d4b6a645ce834b62a5a08d147394c7fd8413a15d47194fd5990d4e3ddcaa28c468d27fb89281b92f72bfb8a63ac208defa8f23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5323481f358f703ee33d266d81b80aa7d
SHA19cb18af0d0e115e835ebf70c677667bc389a8d55
SHA256e5851b71510aa1be7efd8998ccf87abf632a48ec76ab38eeb5f00db3795c4a22
SHA51206157c4b183fb48392920ef26aa4387ad454da3c6ac9845fabc651de94611f21d56d1d499c0256e4f915ea7c560de1b8f6ddcfdb1232a03fa892178fdaa5969e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06