# Unnamed PHP backdoor leveraging php-win.exe and cutt.ly shortened-URL C2 (scheduled task 'ClockLauncher')

> dfir.ch dissects an unnamed PHP-based remote access tool that polls a cutt.ly shortened URL, decodes the utm_source value in the redirect Location header (URL-decode, then double Base64) and runs the result with eval(). It persists via a SYSTEM scheduled task 'ClockLauncher' that runs run-clock.bat, which launches 5.php with the windowless GUI binary php-win.exe. The authors report the EDR products they tested did not alert on the PHP execution.

- **Published:** 2026-10-20T12:08:31Z
- **Last reviewed:** 2026-10-20T12:08:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3955
- **ID:** TL-2026-3955
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The backdoor was found during incident response by Asger Deleuran Strunk and dissected by Stephan Berger (dfir.ch, published 2025-11-16). Persistence is a scheduled task named ClockLauncher (C:\Windows\System32\Tasks\ClockLauncher). The task XML shows a boot trigger, RunLevel HighestAvailable, principal S-1-5-18 (SYSTEM), a registration date of 2025-10-01 and the author string COMPANY\ADM. The task launches run-clock.bat from C:\Windows\Temp\{0B1281F3-C9BC-4B85-AD92-0803ED04208F}\php_2\. That batch file changes into the directory and starts php-win.exe against 5.php, which loops indefinitely.

php-win.exe is a legitimate PHP distribution binary. It is the same interpreter as php.exe but is flagged as a GUI application instead of a console application, so it runs with no visible window. Dropping a portable PHP runtime into a temp directory lets the operator run a scripting-language implant without any custom compiled binary.

5.php runs a loop with a randomized sleep (the analysis reports rand(10, 30) seconds). Each iteration uses curl to request the shortened URL https://cutt.ly/praXEwzs and reads the HTTP Location header of the redirect. The command URL is built from the utm_source query parameter in that header. The value is URL-decoded, then Base64-decoded twice. The content retrieved from the resulting URL is passed to eval(). Using a URL shortener as a dead-drop means the operator can change tasking by editing the shortlink destination, and the only network indicators are connections to cutt.ly and whatever host the decoded URL points to. The source publishes no hashes, IPs, attribution or malware-family name.

A service named ClockSystemService (LocalSystem) was also present and stopped during the investigation, which suggests secondary persistence.

In lab reproductions the authors used a simplified PHP stub (curl to a pastebin.com raw URL followed by eval) and then used PHP system() calls to download and silently install an RMM agent (Bluetrait) with msiexec /qn. They report that the EDR they tested raised only a single medium alert, for the attempted Atera installation, and nothing for php-win.exe execution or the Bluetrait installation. The Bluetrait service installation was visible as Windows Event ID 7045 with an image path under C:\php8.4. The pastebin and Bluetrait items are lab artifacts, not observed attacker infrastructure. Detection guidance from the source is to review AutoRuns data for suspicious scheduled tasks. Severity is an analyst judgment; no CVE is involved.

## MITRE ATT&CK

- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1059 Command and Scripting Interpreter
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1543.003 Create or Modify System Process: Windows Service
- T1564.003 Hide Artifacts: Hidden Window
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218.007 System Binary Proxy Execution: Msiexec
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.001 Web Service: Dead Drop Resolver
- T1219 Remote Access Tools

## Sources

- [Dissection of a PHP Backdoor leveraging php-win.exe (Stephan Berger)](https://dfir.ch/posts/dissection_php_backdoor/)
- [dfir.ch blog (Stephan Berger)](https://dfir.ch/)
- [MITRE ATT&CK T1053.005 Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [MITRE ATT&CK T1102.001 Dead Drop Resolver](https://attack.mitre.org/techniques/T1102/001/)
- [MITRE ATT&CK T1219 Remote Access Tools](https://attack.mitre.org/techniques/T1219/)
- [MITRE ATT&CK T1564.003 Hidden Window](https://attack.mitre.org/techniques/T1564/003/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3955