fsutil.exe

  • File Path: C:\Windows\system32\fsutil.exe
  • Description: fsutil.exe

Hashes

Type Hash
MD5 5A946DE1BE7650FE36F165BA275D6041
SHA1 4C3A12FB2F70B1B51E2AFEC6A57020A46F3B5D19
SHA256 C302730B6088C6E28D1D9692D4D7D512C622979E58A1F6CCEC396AC1231F3DE2
SHA384 CE1396D7B3A518F1517A9C01E407983BA5A087A27DA9EE4F2F262AE20C6148B80D94AEC3526FB7A011FE30505F7C2EFF
SHA512 178C9033F513B64DECC15B2DA91BF3AC1D6CCAAE94ADDF557FAED134BB1B4C54355DB191A9A66DEF38C4EF2BD1B6A652B0A57AF3F8E26C286B94BC9BDF9BF7F3
SSDEEP 3072:Ni8n7ZB1tIRkH6VVadIA16IltsV6NSga1PnNlXY1XoD+VlOd2bhhU9+y8fOpr2u1:b7ZTtIRkH6VVadIA16IltsV6NSga1jXe
IMP 2899A95AD421A518591D7F87D363DB79
PESHA1 1E7F35F87632EC41F35F61E1CD3ABE0ACF5B98A3
PE256 47FFD67631E0DDB7F139D0D17BCC97112DEDD8C0A5DDDBE99F91E90D428B8E47

Runtime Data

Usage (stdout):

--help is an invalid parameter.
---- Commands Supported ----

8dot3name       8dot3name management
behavior        Control file system behavior
dax             Dax volume management
dirty           Manage volume dirty bit
file            File specific commands
fsInfo          File system information
hardlink        Hardlink management
objectID        Object ID management
quota           Quota management
repair          Self healing management
reparsePoint    Reparse point management
resource        Transactional Resource Manager management
sparse          Sparse file control
tiering         Storage tiering property management
transaction     Transaction management
usn             USN management
volume          Volume management
wim             Transparent wim hosting management

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: fsutil.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.652 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.652
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/c302730b6088c6e28d1d9692d4d7d512c622979e58a1f6ccec396ac1231f3de2/detection/

Possible Misuse

The following table contains possible examples of fsutil.exe being misused. While fsutil.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_fsutil_symlinkevaluation.yml title: Fsutil Behavior Set SymlinkEvaluation DRL 1.0
sigma proc_creation_win_fsutil_symlinkevaluation.yml - https://docs.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior DRL 1.0
sigma proc_creation_win_fsutil_symlinkevaluation.yml Image\|endswith: fsutil.exe DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml title: Fsutil Suspicious Invocation DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml description: Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others). DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml Image\|endswith: '\fsutil.exe' DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml OriginalFileName: 'fsutil.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \fsutil.exe DRL 1.0
atomic-red-team index.md - Atomic Test #1: Indicator Removal using FSUtil [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Indicator Removal using FSUtil [windows] MIT License. © 2018 Red Canary
atomic-red-team T1070.md - Atomic Test #1 - Indicator Removal using FSUtil MIT License. © 2018 Red Canary
atomic-red-team T1070.md ## Atomic Test #1 - Indicator Removal using FSUtil MIT License. © 2018 Red Canary
atomic-red-team T1070.md will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn MIT License. © 2018 Red Canary
atomic-red-team T1070.md fsutil usn deletejournal /D C: MIT License. © 2018 Red Canary
atomic-red-team T1070.md fsutil usn createjournal m=1000 a=100 c: MIT License. © 2018 Red Canary
signature-base crime_badrabbit.yar $s4 = “fsutil usn deletejournal /D %c:” fullword wide CC BY-NC 4.0
signature-base crime_nopetya_jun17.yar $x5 = “fsutil usn deletejournal /D %c:” fullword wide CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

fsutil

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, Windows 7

Performs tasks that are related to file allocation table (FAT) and NTFS file systems, such as managing reparse points, managing sparse files, or dismounting a volume. If it’s used without parameters, fsutil displays a list of supported subcommands.

[!NOTE] You must be logged on as an administrator or a member of the Administrators group to use fsutil. This command is quite powerful and should be used only by advanced users who have a thorough knowledge of Windows operating systems.

You must enable Windows Subsystem for Linux before you can run fsutil. Run the following command as Administrator in PowerShell to enable this optional feature:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux

You’ll be prompted to restart your computer once it’s installed. After your computer restarts, you’ll be able to run Fsutil as an administrator.

Parameters

Subcommand Description
fsutil 8dot3name Queries or changes the settings for short name behavior on the system, for example, generates 8.3 character-length file names. Removes short names for all files within a directory. Scans a directory and identifies registry keys that might be impacted if short names were stripped from the files in the directory.
fsutil dirty Queries whether the volume’s dirty bit is set or sets a volume’s dirty bit. When a volume’s dirty bit is set, autochk automatically checks the volume for errors the next time the computer is restarted.
fsutil file Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file’s short name, sets a file’s valid data length, sets zero data for a file, creates a new file of a specified size, finds a file ID if given the name, or finds a file link name for a specified file ID.
fsutil fsinfo Lists all drives and queries the drive type, volume information, NTFS-specific volume information, or file system statistics.
fsutil hardlink Lists hard links for a file, or creates a hard link (a directory entry for a file). Every file can be considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links, so a single file can appear in many directories (or even in the same directory, with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all links to it are deleted. After you create a hard link, programs can use it like any other file name.
fsutil objectid Manages object identifiers, which are used by the Windows operating system to track objects such as files and directories.
fsutil quota Manages disk quotas on NTFS volumes to provide more precise control of network-based storage. Disk quotas are implemented on a per-volume basis and enable both hard- and soft-storage limits to be implemented on a per-user basis.
fsutil repair Queries or sets the self-healing state of the volume. Self-healing NTFS attempts to correct corruptions of the NTFS file system online without requiring Chkdsk.exe to be run. Includes initiating on-disk verification and waiting for repair completion.
fsutil reparsepoint Queries or deletes reparse points (NTFS file system objects that have a definable attribute containing user-controlled data). Reparse points are used to extend functionality in the input/output (I/O) subsystem. They are used for directory junction points and volume mount points. They are also used by file system filter drivers to mark certain files as special to that driver.
fsutil resource Creates a Secondary Transactional Resource Manager, starts or stops a Transactional Resource Manager, displays information about a Transactional Resource Manager or modifies its behavior.
fsutil sparse Manages sparse files. A sparse file is a file with one or more regions of unallocated data in it. A program will see these unallocated regions as containing bytes with the value zero, but no disk space is used to represent these zeros. All meaningful or nonzero data is allocated, whereas all non-meaningful data (large strings of data composed of zeros) is not allocated. When a sparse file is read, allocated data is returned as stored and unallocated data is returned as zeros (by default in accordance with the C2 security requirement specification). Sparse file support allows data to be deallocated from anywhere in the file.
fsutil tiering Enables management of storage tier functions, such as setting and disabling flags and listing of tiers.
fsutil transaction Commits a specified transaction, rolls back a specified transaction, or displays info about the transaction.
fsutil usn Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume.
fsutil volume Manages a volume. Dismounts a volume, queries to see how much free space is available on a disk, or finds a file that is using a specified cluster.
fsutil wim Provides functions to discover and manage WIM-backed files.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.