Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 11:38
Static task
static1
Behavioral task
behavioral1
Sample
99538d2ba7aec4a49493dfb14631ce8d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
99538d2ba7aec4a49493dfb14631ce8d.html
Resource
win10v2004-20231222-en
General
-
Target
99538d2ba7aec4a49493dfb14631ce8d.html
-
Size
6KB
-
MD5
99538d2ba7aec4a49493dfb14631ce8d
-
SHA1
42dd6dae48ddfb2e729fd9926b3a4a14602cf659
-
SHA256
4f25c80bc05a6eda964062a52cbbb1ec72bc147f7847f82577cb4e2836240809
-
SHA512
563fcab4269eb61658f7d32b4c265c76427b0f1a80c3beffb206878d4ef55dd4d7f168176539acab032d8da7790dbe1183ba0d3744f0d3d5f148b1cf7d86f05f
-
SSDEEP
96:POo5C8kFZXmtVNHECHyjQf4STnUwHxD6PzNufsOkAmCqEPbNVDD/bPEr:PvGXU/ECSjQJDxePq1qEPbrX/TU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006f94951e85196bd09a1d95e2d082b2ad3447a9e7ed0aa492a63e3b019b50c30a000000000e8000000002000020000000f452575ec1d258c841fcc82fb936e69f161802882f5c7869406eeecd040c7ab52000000024f3803273755776e3ae2804ac2191f588fd17cc8d532f5f107da4fee99fc578400000002691a0b93c3eb1e63d1400c1f974911ab3ce7946ccfe21e8f79fb54cc522a4d43d5ad2fc42972220c42cfbef12020e42c558d3269d0f1bcadbc29badef65215f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000f8330a54747c0dca1afbd3149505c514d6ffda8813a49d17c92fa48285bcd671000000000e8000000002000020000000ca7d051ff556a77909ced9b41ed16da80f3317a04eb672d24d80437b022df0b1900000003caa007c8aa517382b6f19e519bd84298d6f00e55e8ba21eb3d278916a434d1204c25de1fa41c16862f199fe73e153d3aab410f3c3eb80c8e0bc69e8fd47370834dc274c83cafd37f5d7bb314fe91b3328ade93a792e3cdadbfc353ce2b395d1c21b12ab9c88db19c9abf2b5f9b9f06b6461681315380e94c24f098c43fdc804a95221f9ce19b0bbd2a2b59304badb96400000004ec71e78e153f348f572460c7a4068c80c939eb78f4688dd01462ce1a2c1057334dc7ffb8dc3f5f1f4f00d2de65420fdb08f8169ac67e8a3aaea67c8366bfd92 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413986185" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C896CB1-CA64-11EE-B273-4AE60EE50717} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50215641715eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2716 1936 iexplore.exe 28 PID 1936 wrote to memory of 2716 1936 iexplore.exe 28 PID 1936 wrote to memory of 2716 1936 iexplore.exe 28 PID 1936 wrote to memory of 2716 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99538d2ba7aec4a49493dfb14631ce8d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e0fad438bdac351fb5ae6f0823537c5
SHA132b67514e1df720ecc6acfdca692b185e2a424b3
SHA25613cddf80a761773a2e289c6b51f8389ab9ecdf47c61caab8648bfa8429e9c2bf
SHA512443b2288d880ed32e34e3bc4c0aa3ff315c37209619849afb30237aa8c125c031ceaa8011b6aac56023609ebb706fded37a1d190c47267aa434dace52aba34b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517c538635067c5f355b23b5c722f750a
SHA1cf70d85e122bc1ce8dbab34ff231b46c0df8a1bc
SHA256bd6bf99d49ac31685deadf848c0c1417af2b27dc32ead990d76cd387232a7eb7
SHA512d3e6e974b3c0be03b16bab3f8e6a372c4b5b874737ceccbad96e8447b5e877452ae95de262972eed1baed832a65d108b97c5cb4545600e94636b1c181ce33a2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51caa9db08fab50df1a4a271b5454615d
SHA1ed41935e1ca12d9e8c12c2b8034f2b20673f0ab6
SHA25663e71b02706f07b27b91646666d66b0664f47caa27abe321b702a33accb2d949
SHA51243ddc4f1c5fc1aa0f62972e891750cc4a4fd08dbee8ffcfe81aad94602e69eaeb2aaed0830d4c1f76da03f7d2b768ba46ef3f5806aecc4bb67b2ff20a80388d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5634e8f5b9f29be7e16785f3bf7b5a71c
SHA1e9e29701f1183e324bd04b85f4a1355cb85f5c01
SHA25613db98b789d3310eea4176a88fd319c3488f8aa1ba4828ebfb524a689458b752
SHA5128b6d6d203d3e091d8920c73214fe579f0cf530fb9fd3d38187b1f21966f493bd3cc2db37acb92f449281649afb8bc6f33b587fd18346ca6c61490b6669816a9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53373373f458108191efc78059a93369a
SHA16e68b852fe315f4c42feaa1fa42f8f2f5ada126f
SHA256eefd43a1ed09f5d9b426a04c14a0daffe32a267b5972ae984c7f12e5f3800dcf
SHA512a2c8cae5cd6c994cffe14ed894f049e5ea1b92d09a564a511865727eb19dbdd584a68336ed2dc18c48b826dda41a1bb86d75c195155609c46752f8da6cce0be1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5391fef29e5ec7053d02ab6b2815da74a
SHA157a3fc88188d5a98410c1896ba82d3dfe411c6c8
SHA256b580435c7e414a8a409be193b3ef4b2551bc8e9443bd2b3cb8fa09c77543f9bd
SHA51261da279020b0108352f94955bedbdaefa84c59e432fee28c02878158acec96361542024117c7b959af4d3c838ad34dd61bd33adf7c344b661686e552aa7a93de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556b25171b7e255e5a7607ae90bdc7b09
SHA15c82920879320af8722ba956cbe1ba68ac00004f
SHA25602c8244a65090225c8e9dcb8dd925b55cb628de1a96f7b2763bbb812b997af79
SHA512f782a915e8ed2e3934409468fd2062c67b7d4141ce0e6f40f9bfe3a682723dec737b6b6fe924043d71b6201d9bef5f2b4eba132a5ffde4faeba51ba469008aeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575cd0ecca8b7586d8501c6955cd2ede0
SHA118ed37452ff5bd0211409af19617724589f3106a
SHA256f4d36ad3d9fca875f74f6eb410a4731ac5bef9aed9713c9fa65936a7aceee1b9
SHA512e7d124a809a662584cd668e01e464f818d65c24306040a4963d806ee7a00c4243a8136115bf04cec83af106cd04a618020aea0cbc4ee65fddf53a1f62c6aa689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c89ba6944c5943c4dcca02c5ba4bfdf
SHA11ad89efb7ce720945ba5feffbabb2518561d2cea
SHA256802bcc6e17f83d5189010ca93173fb92c008cd36ecbd3778f847ef84314feeca
SHA512491a5ffc38c5436d236c3901cb0efca459a75518a0c6294cb37c3bb6c960fbea70bc74709326399127b92ac3930723750144d88d315e86f265c3ec6c5f51a699
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d91e3dbbb0fd2b6407d38dcc9c048b8f
SHA14afb89a0d6ed05dfd4411f27bafa895aaa5826b8
SHA256bfec729d93866be0b5612b5b26b3c7018ad1c1c62375827eb343b99c584ca6c1
SHA512ff2a3b21fca22a18fd4bde1f6dce71406e94714e136ea497fc1b275ed368cd9791854d82081792521ee3faccbe6680fcee5e31596a5cbbacbe899792d7a770e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cea13d9d042ed9547eef1abbcf135018
SHA19bb84cf5a3539066815992aa62cec090541d6b90
SHA256e6568182c72aaaad1cc506e66a5ad5913afaceea1ea6d73a0086e3b2f5d0055e
SHA512639daee6161bcec43ff6d1041c522e98921c3cd2d5420d1ca7181a6cfb1442faff3cf0e6b817173a8eb1346a7a0b574a60a9ba030179b6812e4ca812a8a6d62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d993c5eb2e709d5caf5c48a1d90cd41
SHA17211b68ab80ca7dc1950ae9972dd142a87b2c0e3
SHA2564c4807d4306fa1aebc3786931de78e3a733e813ecda0770162d8dbb0f21d5c00
SHA512f803e7b11591b6e42077c2f722a3cb0ce0f7a492c9817be3201ac83e1e9742d0390a23c403e4a970fecf9779079849c09c40ec70ba38a6aa354e85ccb3438f58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c770625c3293256844f1a66f6f9021b
SHA1497f0ef72f884ede2cfdcc913d8e1706f7737e93
SHA2564eb8932da225ef47cd394de265e4fa9404bd537ec0a8efea4cf95f003dc05e72
SHA51248d264a4acebc476b58c6affa63206fb8639f5d7017e2615494e18e37d3bb0e517da3e6a3455ef4d0d5139d9ddbd3ddf89931ae369905b74de2568fec8be83b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51321f1f38866dcf7b698097a4feb2100
SHA1cb172776ca477907ffb86bf8354b9b2bb7a8a2a8
SHA2565ccaa594e7a370e80d1a5558bd28b239efc868d4982a728bc7ad6b6d1030e42c
SHA51294b2536fe0345a426200599625e233f122ca48ae6e7a0b5691532774178ceb58943fa9076486ef7f4ee68ab610896af52255d7628b87bffe927ce3e5b3fe4898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb3966a83e11d9c3d83c21175940b496
SHA1754f2e5f620b236811cb896dd094a3fd3a188a27
SHA2568751bf655c2db3e02ac53ae581d52cd80eaefda16933f8d04ce5d58af5c52c7c
SHA512abcf1f3b4dbc6cb47a7cac85f400276d51c555411e1d49d7fe1d56eb417c750016dada62f1bb2b7d1e97533ecbb76c8d846f7b643c31af01a80c82f34ff63185
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a48856bfa72771a6581e0bcdbbde7860
SHA179815023de5a1cc76b706f2d6d81798ee5481936
SHA256e8890bf839c02e7385b379a551de537bb3c9867c6a17372f12badd463d386cda
SHA512d005a2c43c0b66b919eb5a61be6caaab5268555a3549f4e6b6cd2d9ee15cdf6d2621239dc09fe08c01112f0b040e33714d1d25d472de41c68dc9b9e82c6a9b2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d04f6a0550fce17d34e79988dbff9e3
SHA1b89a7951d1acd56f3436dbab7d1d4287d70c5897
SHA2565be00fa94d91a0ddf34ebaf16098438e6282c8a76a20e42b9de0161527f5229d
SHA512fa341242f56d1e4ed3b1272f8309f7b67cbd6c5b78b7d966f6504f37c860cb37506993d8a280281ce72492d6eee39d8bf23f590272a37752b1733701fc86990d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557a2e6ddfd116955a5f6bfde665e26d6
SHA1fd429191b30c94ea80b3d769d6e4c45a1302518d
SHA2563c0c4f5884181c596a849bbdc56b00293677a80f76f592980f24342ff71fcec7
SHA512883c522daad4436a118e8cc41f7b42c95014dc1c5f1a7e5c4e156236a888575a5253287c9428f38bdcbde055c1b46d4a17c8f6746fe43f2cd8e403a72057f3f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4f9eab88e82b2989cb3a6141f8782e2
SHA14ed689b00955496827e4f70b5b9556f759d4edd6
SHA25606d8eff0d16ceb7469cdf4b8d6c65ef840f82c5e14fed122ca14e8d48631a6ee
SHA5121743bc316204879088fe19220d8709880077664dc7251524b4e6ffbffac922544722ddb80747654438ad81b80ff6ada931367bc6c780be2f1e19fe2d55c9037c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06