The next stages are located on the C2 server in folders with the victim computer names, so the threat actors have information about which machines were infected and place the next stage modules in specific folders on the C2 server.” “The main module (msdisp64.exe) tries to download the next stage from a hardcoded C2 server set. In this case, the malicious Javascript on the infected site will make multiple AJAX requests to download the RC4-encrypted file, which when decrypted, concatenated and deobfuscated will become a new JS code that will mount the UaF attack to set up the shellcode to decrypt the final payload - a binary file name worst.jpg - into an executable updata.exe which is a compressed RAR SFX containing two files, iohelper.exe and msdisp64.exe. With this, the attacker can now at the same time spray the heap, possibly causing arbitrary code execution.

Once that’s done and real address information is gathered, it will try to spawn multiple large objects (hence the use of BigInt) to build a deterministic heap structure.

However, this does not guarantee the clearing of data, nor, since the now-deallocated pointer is not actually nullify, that the previously allocated memory cannot be referenced again using the same pointer.Įssentially, the attacker will try to exploit a race condition due to “ missing proper synchronization” between threads using the browser’s built-in BigInt() function and various alloc-then-free routine and trigger UaF condition to leak some real address information to defeat ASLR (Address Space Layout Randomization).

When that pointer is deallocated, the memory chunk is updated/merged accordingly to reflect that the block is now free to be allocated again. using malloc()), the memory allocation routine will try to find an empty memory block in the heap (or extend the heap if there isn’t any), generate a memory chunk metadata block that is part of a memory chunk linked list to reflect that the memory location is now allocated/in use, then return the pointer to the newly created memory chunk.

When a memory block is dynamically allocated (e.g.

Google chrome hack 2019