SOC Prime Bias: Medium

25 Mar 2026 17:36
newspaper icon Malwarebytes

That “job brief” on Google Forms could infect your device

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
That “job brief” on Google Forms could infect your device
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Threat actors are abusing Google Forms to distribute malicious ZIP archives that ultimately install the PureHVNC RAT. The archive includes a decoy PDF alongside a malicious executable and DLL pair that execute through DLL hijacking. Once launched, the malware carries out system reconnaissance, steals data, and establishes persistence using registry changes and scheduled tasks.

Investigation

Researchers documented several campaign variants and confirmed abuse of msimg32.dll for DLL hijacking. They observed persistence through the Miroupdate registry Run key, staged execution that drops a final ZIP into ProgramData, and an obfuscated Python loader that runs Donut shellcode. In the final stage, the PureHVNC RAT is injected into SearchUI.exe.

Mitigation

Users should avoid downloading files from untrusted Google Forms pages or shortened links. The legitimacy of shared forms and URLs, especially those delivered through LinkedIn, should be carefully verified. Organizations should enforce URL filtering and endpoint protection to block known malicious files, domains, and payload delivery paths.

Response

Detection teams should look for the presence of msimg32.dll, the Miroupdate Run key, scheduled tasks containing base64 PowerShell, and PureHVNC process injection behavior. Malicious ZIP files should be quarantined, persistence mechanisms removed, and all associated infrastructure domains blocked.

"graph TB %% Class definitions classDef technique fill:#e6f5ff %% Node definitions tech_user_exec["<b>Technique</b> – <b>T1204.001 User Execution: Malicious Link</b><br/><b>Description</b>: Tricks a user into clicking a malicious link that results in execution of malicious code."] class tech_user_exec technique tech_dll_hijack["<b>Technique</b> – <b>T1574.001 Hijack Execution Flow: DLL</b><br/><b>Description</b>: Loads a malicious DLL by hijacking the normal DLL search order or using sideu2011loading techniques."] class tech_dll_hijack technique tech_user_activity["<b>Technique</b> – <b>T1497.002 Virtualization/Sandbox Evasion: User Activity Based Checks</b><br/><b>Description</b>: Checks for real user activity (mouse, keyboard, display) to determine if it is running in a sandbox or virtual environment."] class tech_user_activity technique tech_rc_scripts["<b>Technique</b> – <b>T1037.004 Boot or Logon Initialization Scripts: RC Scripts</b><br/><b>Description</b>: Modifies or creates RC (runu2011control) scripts on Unixu2011like systems to gain persistence at boot or login."] class tech_rc_scripts technique tech_scheduled_task["<b>Technique</b> – <b>T1053 Scheduled Task/Job</b><br/><b>Description</b>: Creates scheduled tasks or jobs that run malicious code at a later time or on a recurring basis."] class tech_scheduled_task technique tech_powershell["<b>Technique</b> – <b>T1059.001 Command and Scripting Interpreter: PowerShell</b><br/><b>Description</b>: Uses PowerShell to execute commands, scripts, or payloads on the victim system."] class tech_powershell technique tech_compress["<b>Technique</b> – <b>T1027.015 Obfuscated Files or Information: Compression</b><br/><b>Description</b>: Compresses or packs malicious files to evade detection and reduce size."] class tech_compress technique tech_dynamic_api["<b>Technique</b> – <b>T1027.007 Obfuscated Files or Information: Dynamic API Resolution</b><br/><b>Description</b>: Resolves API calls at runtime to hide the true intent of the code from static analysis."] class tech_dynamic_api technique tech_process_injection["<b>Technique</b> – <b>T1055 Process Injection</b><br/><b>Description</b>: Injects malicious code into the address space of another running process."] class tech_process_injection technique tech_process_hollow["<b>Technique</b> – <b>T1055.012 Process Injection: Process Hollowing</b><br/><b>Description</b>: Creates a legitimate process in a suspended state and replaces its memory with malicious code."] class tech_process_hollow technique tech_sysinfo["<b>Technique</b> – <b>T1082 System Information Discovery</b><br/><b>Description</b>: Collects operating system, hardware, and configuration details from the victim."] class tech_sysinfo technique tech_browser_info["<b>Technique</b> – <b>T1217 Browser Information Discovery</b><br/><b>Description</b>: Enumerates installed browsers, extensions, and settings to aid further credential theft."] class tech_browser_info technique tech_browser_creds["<b>Technique</b> – <b>T1555.003 Credentials from Password Stores: Credentials from Web Browsers</b><br/><b>Description</b>: Extracts saved usernames and passwords from web browsers."] class tech_browser_creds technique tech_file_creds["<b>Technique</b> – <b>T1552.001 Unsecured Credentials: Credentials In Files</b><br/><b>Description</b>: Searches the file system for credential material stored in plaintext or poorly protected files."] class tech_file_creds technique tech_private_keys["<b>Technique</b> – <b>T1552.004 Unsecured Credentials: Private Keys</b><br/><b>Description</b>: Locates private key files that can be used to impersonate the victim."] class tech_private_keys technique tech_web_cookie["<b>Technique</b> – <b>T1550.004 Use Alternate Authentication Material: Web Session Cookie</b><br/><b>Description</b>: Reuses harvested web session cookies to authenticate to web services without needing passwords."] class tech_web_cookie technique %% Connections tech_user_exec –>|triggers| tech_dll_hijack tech_dll_hijack –>|performs| tech_user_activity tech_dll_hijack –>|uses| tech_rc_scripts tech_rc_scripts –>|creates| tech_scheduled_task tech_scheduled_task –>|executes| tech_powershell tech_powershell –>|packs| tech_compress tech_compress –>|includes| tech_dynamic_api tech_compress –>|enables| tech_process_injection tech_process_injection –>|uses| tech_process_hollow tech_process_hollow –>|gathers| tech_sysinfo tech_process_hollow –>|discovers| tech_browser_info tech_process_hollow –>|steals| tech_browser_creds tech_process_hollow –>|steals| tech_file_creds tech_process_hollow –>|steals| tech_private_keys tech_process_hollow –>|leverages| tech_web_cookie "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An operator compromised the endpoint and deployed PureHVNC. The tool launches a hidden PowerShell process that issues three distinct WMI queries to harvest system information:

    1. SELECT Caption FROM Win32_OperatingSystem – gathers OS version.
    2. SELECT * FROM AntiVirusProduct – enumerates installed AV products.
    3. SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera') – discovers attached cameras and imaging devices.
      The queries are executed via wmic to blend with legitimate administrative activity, but the exact strings match the detection rule’s selection block.

  • Regression Test Script:

    # PureHVNC WMI query simulation – triggers the detection rule
$queries = @(
    "SELECT Caption FROM Win32_OperatingSystem",
    "SELECT * FROM AntiVirusProduct",
    "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')"
)

foreach ($q in $queries) {
    # Use wmic to execute the query; wmic prints output to stdout
    wmic /namespace:\rootcimv2 path __Namespace where "Name='root'" call CreateInstance $q 2>$null
    # Force a short pause to ensure each event is logged separately
    Start-Sleep -Milliseconds 500
}

  • Cleanup Commands:

    # Remove any temporary files and terminate lingering wmic processes
Get-Process wmic -ErrorAction SilentlyContinue | Stop-Process -Force
# No persistent artifacts are created by the above script.

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free