setupugc.exe

Commands

1. ExecuteAdministrator T1218

   Execute binary through legitimate proxy

   setupugc.exe specialize

   By first setting a command to a specific registry under Setup-Unattend-Settings, e.g. via: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\1" /v Path /d "{CMD}" /f, executing the following will cause it to execute the command.

   os: Windows 10, Windows 11, Windows Server 2025

   Execute: CMDRequires: Registry Change

2. ExecuteAdministrator T1218

   Execute binary through legitimate proxy

   setupugc.exe auditUser

   Same technique as above, but using the auditUser command-line option.

   os: Windows 10, Windows 11, Windows Server 2025

   Execute: CMDRequires: Registry Change

Detection

• IOC`setupugc.exe` spawning child processes outside of Windows Setup context. Legitimate parents are `setuphost.exe` or `setup.exe`.
• IOCRegistry writes to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\` on a deployed system.

Resources

• https://strontic.github.io/xcyclopedia/library/setupugc.exe-3CFE082E8656AD66B5B9FFEB28CF4EC3.html