Identifier / Programs / Windows
setupugc.exe
Setup Unattend Generic Command Processor file version info (xCyclopedia)
LOLBAS Execute 1 ATT&CK technique 2 documented commands 18 known copies with hashes
How setupugc.exe is abused
Execute T1218 System Binary Proxy Execution
specialize
Execute T1218 System Binary Proxy Execution
audituser
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for setupugc.exe.
2 documented commands
Execute T1218 System Binary Proxy Execution Administrator privileges
By first setting a command to a specific registry under Setup-Unattend-Settings, e.g. via: reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UnattendSettings\Setup-Unattend-Settings\RunSynchronous\1" /v Path /d "{CMD}" /f, executing the following will cause it to execute the command.
setupugc.exe specializeExecute T1218 System Binary Proxy Execution Administrator privileges
Same technique as above, but using the auditUser command-line option.
setupugc.exe auditUserNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for setupugc.exe, by Ang Kar Min, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for setupugc.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real setupugc.exe?
C:\Windows\system32\C:\Windows\SysWOW64\18 known copies
10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\system32\setupugc.exe · signed by Microsoft Windows
8380f88fe88ba3d349357309d2c94a86c29ef1a29d726d13a5b8739caf7ee8a110.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\setupugc.exe · signed by Microsoft Windows
8eedd064521391298751892dccf81c1b87e05433f19e46bcd9125703ebeb452310.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setupugc.exe · signed by Microsoft Windows
de6fd33ba98dc97bdf55c29459a0afd892db9ba350bd3d0bad4b8365e7e2bdbe10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setupugc.exe · signed by Microsoft Windows
7e3e17e8d56d07b33f55749f2ddf4f16a3b5c74e574449a52f8f91f796e9ee4210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\setupugc.exe · signed by Microsoft Windows
6ca35b1605ed1c3ba18181163fb8376fc7c080d2dc4dce1d726eb41cb92e975410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setupugc.exe · signed by Microsoft Windows
6dabf229851a6597076d2e032de26bc1b85e99685151920427dab6aa0d1cf28610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\setupugc.exe · signed by Microsoft Windows
aae6db852b70a4e92784c7e7b6dc27e7a0640b1849a780e759d228799eea328210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\setupugc.exe · signed by Microsoft Windows
fb141f1edac57971a862de01d28e17d2e0a5cc043cfab85a614c60527e71017a10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\setupugc.exe · signed by Microsoft Windows
3d7a078462bcfcc819705ab422cd054830017fd7045adc1010719e686039e83a10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\setupugc.exe · signed by Microsoft Windows
8aaac34a98adeaba1274f4b6077652427d8d2136804425c745d3426d41dcfeb210.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setupugc.exe · signed by Microsoft Windows
d1075cec07787200d3637f001fa7f2467c6601d41afd2d2aa410282e1d479f7110.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\setupugc.exe · signed by Microsoft Windows
0c20322a2009e5d986e31483811218b8ab8a8e23fa87a61e8f9126236b7a2d1810.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\setupugc.exe · signed by Microsoft Windows
1ce5f75ee898393f1f0e9a96b63c9ec84349beb282cdc78fd69ef090daa7842810.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\setupugc.exe · signed by Microsoft Windows
f82f49488663dcb004a2924cb4578b74072192e24787ade190208bd04e6f415910.0.14393.2879 (rs1_release_inmarket.190313-1855) · C:\Windows\SysWOW64\setupugc.exe · signed by Microsoft Windows
60b3253334536536a08ed61fa46907087130386677ed83d49ffa20437b97e0ce10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\setupugc.exe · signed by Microsoft Windows
0cb4ab0d870ae7248c5df61067fb51f4183e4993fa2e6a29d659d5e55fe0d1d36.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\setupugc.exe · not signed
f86944cfece2d19515389c9bb8775cddb1d0944fa2e1ae351c4e0796ef650fea6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\setupugc.exe · not signed
f68597747905687df9b28b0b11b0bc7f71ddd4d1f11578b578241837e7255205From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.