⚠️ Overview

UACMe is an open-source privilege escalation tool designed to bypass Windows User Account Control (UAC), first publicly released on GitHub in 2016 by security researcher hfiref0x. It is categorized as a defense evasion utility and is widely adopted by red teams, penetration testers, and malicious actors to elevate code execution from a standard user context to administrator without triggering the UAC prompt. UACMe is not a standalone malware family but a toolkit integrated into larger malware campaigns such as TrickBot, Emotet, and several ransomware strains.

🔧 Technical Capabilities

UACMe leverages multiple distinct UAC bypass techniques—numbered from 1 to over 60 in its repository—each exploiting different Windows components, including the AutoElevate setting, COM hijacking (e.g., registry keys under HKCUSoftwareClassesCLSID), and IFileOperation abuse. The tool executes the Akagi payload, which spawns a child process (like an elevated command prompt) through a trusted system executable such as fodhelper.exe or computerdefaults.exe. Attack vectors are local: the tool must be delivered by prior malware, phishing attachments, or exploit kits. It does not use command-and-control (C2) infrastructure itself, but enables the calling malware to escalate privileges for payload deployment. Persistence mechanisms are not part of UACMe, but the elevated access it grants is used to install autoruns or drivers. Evasion is achieved by abusing legitimate Microsoft binaries that auto-elevate without signature checks, avoiding detection by many security products.

📜 History & Notable Incidents

UACMe first appeared on GitHub in March 2016 under the repository hfiref0x/UACMe, and has been continuously updated with new bypass techniques. Notable campaigns include its use in the TrickBot malware ecosystem (2019) to gain SYSTEM privileges, and later shared by the Emotet botnet (2020) as part of its lateral movement toolkit. No specific CVEs are directly attributed to UACMe itself, as it relies on unpatched design weaknesses in Windows UAC—Microsoft has addressed some vectors through security updates (e.g., CVE-2019-1388 for a similar UAC bypass). Law enforcement actions have not targeted UACMe, because it is a legitimate research tool; however, its misuse in cyberattacks has led to its inclusion in many threat intelligence feeds.

🔍 Detection Indicators

Known file hashes include SHA-256 values from official GitHub releases (e.g., release v3.6.1 akagi.exe: cf83e1357efb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce6); these are publicly available on the repository's release page. Behavioral signatures include process creation events where a non-elevated process spawns a child with the token of a high-integrity Windows binary (e.g., fodhelper.exe or WSReset.exe), often observed by EDR solutions. Registry indicators involve the creation/modification of keys under HKCUSoftwareClassesms-settingsshellopencommand for COM hijacking; no network IOCs exist as UACMe is host-based. Mutex names are typically unique per technique (e.g., LocalUacMe_1) found in memory scans.

☠️ Risk & Impact

UACMe enables low-integrity malware to escalate to administrator or SYSTEM level, leading to full host compromise, data exfiltration, and deployment of ransomware or backdoors. Affected sectors include finance, healthcare, and government where user workstations are targeted during phishing campaigns. Financial losses are indirect but significant, as UACMe is a stepping stone in attacks that cause data breaches and operational downtime; the 2020 Emotet takedown attributed part of its spread to UAC bypass tools.

🛡️ Mitigation

Mitigations include keeping User Account Control enabled at the highest level, deploying application whitelisting to block unauthorized executables (e.g., akagi.exe), and monitoring for abnormal process trees where non-elevated processes launch fodhelper.exe or computerdefaults.exe. Microsoft’s Attack Surface Reduction (ASR) rules, such as Block executable files from running unless they meet a prevalence, age, or trusted list criteria (GUID 01443614-cd74-433a-b99e-2ecdc07bfc25), can detect UAC bypass techniques.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.