HP SVCReady Jun 2022

SVCReady can collect data from an infected host.

SVCReady can search for the `HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System` Registry key to gather system information.

SVCReady can encrypt victim data with an RC4 cipher.

SVCReady can collect the username from an infected host.

SVCReady has named a task `RecoveryExTask` as part of its persistence activity.

SVCReady can send collected data in JSON format to its C2 server.

SVCReady can use `WMI` queries to detect the presence of a virtual machine environment.

SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.

SVCReady can collect a list of running processes from an infected host.

SVCReady has used VBA macros to execute shellcode.

SVCReady can communicate with its C2 servers via HTTP.

SVCReady has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.

SVCReady has the ability to download additional tools such as the RedLine Stealer to an infected host.

SVCReady can use Windows API calls to gather information from an infected host.

SVCReady can take a screenshot from an infected host.

SVCReady can check for the number of devices plugged into an infected host.

SVCReady can collect time zone information.

SVCReady has relied on users clicking a malicious attachment delivered through spearphishing.

SVCReady has used `rundll32.exe` for execution.

SVCReady has the ability to determine if its runtime environment is virtualized.

SVCReady can enter a sleep stage for 30 minutes to evade detection.

SVCReady can collect a list of installed software from an infected host.

SVCReady has created the `HKEY_CURRENT_USER\Software\Classes\CLSID\{E6D34FFC-AD32-4d6a-934C-D387FA873A19}` Registry key for persistence.

SVCReady has been distributed via spearphishing campaigns containing malicious Mircrosoft Word documents.