DcRAT MixedSvc Service Persistence via sc.exe Creating Windows Mixed Reality Service

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the creation of a Windows service named 'MixedSvc' that points to the suspicious path 'C:\Program Files\Windows Media Player\Mixed Reality.exe'. This behavior is associated with DcRAT's Operation DragonReturn, where the malware attempts to establish persistence on the host by masquerading as a Windows Media Player component.