# Dissection of a PHP Backdoor Leveraging php-win.exe for Stealthy Windows Persistence

> DFIR.ch documented a custom PHP backdoor (5.php) found during an incident-response engagement that runs invisibly via the GUI-subsystem interpreter php-win.exe and persists as a scheduled task (ClockLauncher) plus a Windows service (ClockSystemService). It fetches commands through a cutt.ly redirect header and Pastebin, decodes them with double Base64, executes them via eval(), and was used to deploy the Atera and Bluetrait.IO RMM agents without triggering the tested EDR.

- **Published:** 2026-08-26T00:00:00Z
- **Last reviewed:** 2026-08-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2149
- **ID:** TL-2026-2149
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

During an incident response engagement, DFIR.ch discovered a custom PHP-based backdoor (`5.php`) persisted on a Windows host through a scheduled task named `ClockLauncher` and a companion service named `ClockSystemService`, both configured to run as LocalSystem (S-1-5-18) with HighestAvailable privileges. Instead of the standard console-mode `php.exe`, the attacker used `php-win.exe` — a GUI-subsystem build of the PHP interpreter that never spawns a visible console window — invoked through a batch launcher (`run-clock.bat`) from a UUID-named folder under `C:\Windows\Temp`.

At runtime, the backdoor issues HTTP HEAD requests to a cutt.ly-shortened URL (`https://cutt.ly/praXEwzs`) at randomized 10-30 second intervals, reads the `utm_source` query parameter off the HTTP redirect `Location` header, URL-decodes it, applies a second layer of Base64 decoding, and hands the result to PHP's `eval()` for execution — abusing a benign URL-shortener redirect as a covert command channel (a dead-drop-resolver pattern) rather than standing up dedicated C2 infrastructure. DFIR.ch's lab reproduction of the fetch chain also referenced a secondary payload hosted on Pastebin.

Commands retrieved through this channel were used to attempt a silent install of the Atera RMM agent (blocked by a security control, and the only step in the entire chain to generate a — medium-severity — EDR alert) and to successfully install the Bluetrait.IO RMM agent, which checked in to `https://dfir.bluetrait.io/simple/msp_download_agent`. The Bluetrait install left no EDR alert at all, surfacing only as a routine Windows Security Event ID 7045 (service installation), and the host's application inventory recorded the installation source as `C:\php8.4` rather than the true Temp-directory origin. The author states plainly that at least one tested EDR product did not raise a single alert across the full chain, from PHP code execution through RMM-agent installation, and that the backdoor was only found by hunting through AutoRuns data across the environment. No CVE, exploit, or named threat actor is associated with this activity; the significance is the novel invisible-execution technique (GUI-subsystem PHP interpreter) and the demonstrated detection gap across a common EDR/RMM combination, which is directly actionable for detection engineering.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1543.003 Create or Modify System Process: Windows Service
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564.003 Hide Artifacts: Hidden Window
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1219 Remote Access Tools

## Sources

- [Dissection of a PHP Backdoor leveraging php-win.exe](https://dfir.ch/posts/dissection_php_backdoor/)
- [The 6 URL Shorteners You Didn't Know Were Helping Hackers](https://cofense.com/blog/the-6-url-shorteners-you-didn-t-know-were-helping-hackers)
- [Understanding and Threat Hunting for RMM Software Misuse](https://www.intel471.com/blog/understanding-and-threat-hunting-for-rmm-software-misuse)
- [MuddyWater Campaign Abusing Atera Agents](https://harfanglab.io/insidethelab/muddywater-rmm-campaign/)
- [PHP Webshell Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/php-webshell)
- [Web Service: Dead Drop Resolver (T1102.001) — MITRE ATT&CK](https://attack.mitre.org/techniques/T1102/001/)
- [Remote Access Software (T1219) — MITRE ATT&CK](https://attack.mitre.org/techniques/T1219/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2149