LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1064: SVCReady

SVCReady is a loader that has been used since at least April 2022 in malicious spam campaigns. Security researchers have noted overlaps between TA551 activity and SVCReady distribution, including similarities in file names, lure images, and identical grammatical errors.[1]

EnterpriseS1064MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

SVCReady matters because it is a Windows loader associated in ATT&CK with malicious spam delivery and a broad set of follow-on behaviors: phishing attachment execution, discovery, persistence, stealth, command-and-control, tool transfer, collection, and exfiltration over C2. For leaders, the decision value is not simply “do we block this malware name,” but whether email, endpoint, identity, and SOC processes can catch a user-driven loader before it establishes persistence, profiles the host, pulls additional tooling, or moves data through normal-looking web traffic.

Executive priority

Prioritize SVCReady as a readiness test for phishing-led intrusion response on Windows endpoints. It connects business risk to several control areas executives can validate: attachment handling and user execution controls, endpoint visibility for scheduled tasks, WMI, rundll32, registry and COM activity, and network visibility for web-based C2 and exfiltration. Because ATT&CK provides no official detection text for this software, leadership should ask for evidence of coverage against the mapped behaviors rather than relying on signature coverage for the SVCReady name alone. The official description notes overlaps with TA551 activity in distribution artifacts, but this should be treated as contextual threat intelligence, not attribution.

Technical view

SOC and detection teams should validate behavior-based coverage across the Windows attack chain reflected in the relationships: spearphishing attachment and malicious file execution; Visual Basic, WMI, Native API, and rundll32 execution; registry queries and COM hijacking; scheduled task persistence; system, user, process, software, peripheral, and time discovery; anti-analysis checks; ingress tool transfer; web-protocol C2; local data collection, screen capture, and exfiltration over the C2 channel. Since ATT&CK lists no dedicated detection guidance for SVCReady, detections should be built and tested around these related techniques, correlated by sequence and endpoint context rather than single events.

Likely telemetry

  • Email security telemetry for attachments, sender metadata, lure delivery, and user interaction with malicious files
  • Endpoint process creation telemetry, including parent-child relationships for Office or attachment handlers, script interpreters, rundll32.exe, WMI, and scheduled task utilities
  • Windows Registry and COM-related telemetry for discovery, modification, or hijacking indicators
  • Scheduled task creation, modification, and execution logs
  • WMI activity logs and remote or local management execution evidence

Detection direction

  • Validate behavior chains rather than only malware signatures: phishing attachment execution followed by script or rundll32 execution, discovery, persistence, and outbound web traffic is higher-value than any single event.
  • Tune for suspicious scheduled task and service naming, especially where names appear designed to masquerade as legitimate tasks or services.
  • Correlate WMI, Visual Basic, Native API, and rundll32 activity with unusual parents, recently written files, user-opened attachments, or uncommon command-line patterns.
  • Monitor registry and COM activity for both discovery and persistence context; separate common administrative inventory activity from changes that introduce suspicious execution paths.
  • Review outbound web-protocol traffic from newly spawned or unusual processes, especially when paired with tool transfer, local data access, or screen capture behaviors.

Mitigation priorities

  • Strengthen email attachment controls and user-execution safeguards for malicious spam scenarios, including attachment detonation, file-type handling, and user reporting workflows.
  • Reduce script, WMI, rundll32, and scheduled task abuse opportunities through least privilege, application control, and administrative tool governance appropriate to Windows endpoints.
  • Harden persistence surfaces by monitoring and controlling scheduled tasks, services, registry autoruns, and COM object references.
  • Ensure endpoint detection and response coverage captures process, registry, task, WMI, file, and network events needed to reconstruct the chain.
  • Restrict and inspect outbound web traffic where feasible so C2, tool transfer, and exfiltration over common protocols are not invisible by default.
Additional notes and limits

ATT&CK identifies SVCReady as a Windows loader used since at least April 2022 in malicious spam campaigns. The relationship set is rich and gives defenders practical coverage targets across initial access, execution, discovery, persistence, stealth, command-and-control, collection, and exfiltration behaviors. The strongest defensive use is to map existing telemetry and detections to those behaviors and validate whether the SOC can connect them into an incident narrative quickly.

The official ATT&CK object provides no dedicated detection text, no explicit tactics on the malware object itself, and no aliases or labels. Relationship descriptions include techniques with platforms beyond Windows, but the SVCReady object platform is Windows; platform claims should therefore remain Windows-focused. Local telemetry, control configuration, and observed samples are required to determine actual exposure or detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

SVCReady

SVCReady is a loader that has been used since at least April 2022 in malicious spam campaigns. Security researchers have noted overlaps between TA551 activity and SVCReady distribution, including similarities in file names, lure images, and identical grammatical errors.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

24 rows
DomainIDNameRelationship / procedure
EnterpriseT1012Query Registry

SVCReady can search for the `HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System` Registry key to gather system information.[1]

EnterpriseT1027Obfuscated Files or Information

SVCReady can encrypt victim data with an RC4 cipher.[1]

EnterpriseT1204.002Malicious FileSub-technique

SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.[1]

EnterpriseT1005Data from Local System

SVCReady can collect data from an infected host.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.[1]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

SVCReady has named a task `RecoveryExTask` as part of its persistence activity.[1]

EnterpriseT1059.005Visual BasicSub-technique

SVCReady has used VBA macros to execute shellcode.[1]

EnterpriseT1218.011Rundll32Sub-technique

SVCReady has used `rundll32.exe` for execution.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.[1]

EnterpriseT1105Ingress Tool Transfer

SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.[1]

EnterpriseT1041Exfiltration Over C2 Channel

SVCReady can send collected data in JSON format to its C2 server.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

SVCReady can communicate with its C2 servers via HTTP.[1]

EnterpriseT1120Peripheral Device Discovery

SVCReady can check for the number of devices plugged into an infected host.[1]

EnterpriseT1033System Owner/User Discovery

SVCReady can collect the username from an infected host.[1]

EnterpriseT1546.015Component Object Model HijackingSub-technique

SVCReady has created the `HKEY_CURRENT_USER\Software\Classes\CLSID\{E6D34FFC-AD32-4d6a-934C-D387FA873A19}` Registry key for persistence.[1]

EnterpriseT1113Screen Capture

SVCReady can take a screenshot from an infected host.[1]

EnterpriseT1124System Time Discovery

SVCReady can collect time zone information.[1]

EnterpriseT1106Native API

SVCReady can use Windows API calls to gather information from an infected host.[1]

EnterpriseT1047Windows Management Instrumentation

SVCReady can use `WMI` queries to detect the presence of a virtual machine environment.[1]

EnterpriseT1082System Information Discovery

SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.[1]

EnterpriseT1497.001System ChecksSub-technique

SVCReady has the ability to determine if its runtime environment is virtualized.[1]

EnterpriseT1057Process Discovery

SVCReady can collect a list of running processes from an infected host.[1]

EnterpriseT1518Software Discovery

SVCReady can collect a list of installed software from an infected host.[1]

EnterpriseT1497.003Time Based ChecksSub-technique

SVCReady can enter a sleep stage for 30 minutes to evade detection.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1546.015: Component Object Model HijackingEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1497.003: Time Based ChecksEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
632a8a81b7031f64...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle632a8a81b703…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  2. [2]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  3. [3]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  4. [4]
    mitre-attackS1064
    Open source URL
  5. [5]
    mitre-attackS1064
    Open source URL
  6. [6]
    mitre-attackS1064
    Open source URL
  7. [7]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  8. [8]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  9. [9]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  10. [10]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  11. [11]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  12. [12]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  13. [13]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  14. [14]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  15. [15]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  16. [16]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  17. [17]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  18. [18]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  19. [19]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  20. [20]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  21. [21]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  22. [22]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  23. [23]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  24. [24]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  25. [25]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  26. [26]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  27. [27]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  28. [28]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  29. [29]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  30. [30]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  31. [31]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  32. [32]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  33. [33]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  34. [34]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  35. [35]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  36. [36]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  37. [37]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  38. [38]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  39. [39]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  40. [40]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  41. [41]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  42. [42]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  43. [43]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  44. [44]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  45. [45]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  46. [46]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  47. [47]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  48. [48]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  49. [49]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  50. [50]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  51. [51]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  52. [52]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
  53. [53]
    HP SVCReady Jun 2022

    Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use