Dissection of a PHP Backdoor leveraging php-win.exe

What it is

An IR case study of a PHP backdoor (5.php) found running as php-win.exe under a scheduled task ClockLauncher. The value of this page over the summary is the concrete artifacts: file paths, the task XML, the exact backdoor source, and the detection reasoning — enough to hunt for it.

How it works

The backdoor runs an infinite loop, sleeping a random 10–30s each iteration. It sends a curl HEAD-only request (CURLOPT_NOBODY, follow redirects, headers only) to a cutt.ly short link and regex-scans the returned headers for utm_source=. The extracted value is URL-decoded, then Base64-decoded twice to reconstruct a second-stage URL. It fetches that URL's body and passes it straight to eval('?>' . $response). The C2 pointer thus lives in the utm_source UTM parameter of a shortener's Location: redirect header — the visible short link can point anywhere innocuous. The author confirms the mechanism by creating his own cutt.ly link and showing the header:

$ curl -I -L https://cutt.ly/Yr7EQmQa
location: https://dfir.ch/posts/sysrv/?utm_source=dfir.ch

The $mem comparison means the payload only re-executes when the utm_source value changes.

Preconditions / Affected

Windows host with a PHP interpreter dropped by the attacker. Persistence was established as SYSTEM: the scheduled task runs S-1-5-18 at HighestAvailable on a BootTrigger. A second mechanism, a service ClockSystemService running as LocalSystem, was also present (stopped at investigation time).

What to do

Hunt for these host IOCs:

• Directory C:\Windows\Temp\{0B1281F3-C9BC-4B85-AD92-0803ED04208F}\php_2\ containing run-clock.bat, php-win.exe, 5.php.
• Scheduled task ClockLauncher (C:\Windows\System32\Tasks\ClockLauncher).
• Service ClockSystemService under LocalSystem.
• Outbound requests to cutt.ly (observed: https://cutt.ly/praXEwzs).

Detection note the post raises: the attacker chose php-win.exe rather than php.exe specifically because php.exe spawns a conhost.exe terminal window — php-win.exe runs windowless and quieter. Any php-win.exe process, especially from a Temp GUID directory or launched by a .bat, is worth alerting on.

flowchart LR
  T[ClockLauncher task / SYSTEM] --> B[run-clock.bat]
  B --> P[php-win.exe 5.php]
  P -->|HEAD, headers only| S[cutt.ly short link]
  S -->|Location: utm_source=| D[urldecode + double base64]
  D --> F[fetch payload URL]
  F --> E[eval]

Caveats

The page is truncated mid-sentence in the "Lab Time & Detection" section, so the full detection/YARA content beyond the php-win.exe vs php.exe observation isn't captured here. The second-stage payload itself was not recovered in the text — only the delivery mechanism.