fsutil.exe

  • File Path: C:\windows\SysWOW64\fsutil.exe
  • Description: fsutil.exe

Hashes

Type Hash
MD5 6A6F3AABC9F80BEA07BC927C0A37566F
SHA1 8D71DD75C885DA7D3064F7D0677596A75433FE42
SHA256 4C948318B04DADB58926818D02776129B651A134E01E28D7B6707994A83A0227
SHA384 34258828D62A5BEF07886F855B36AA98FA5C33F2DD0A46D26D7380023358C7F4E74D94A47146DE964D8534E2E2DB49A7
SHA512 3F94C5E648E5F6CDCB474C5261A36EC69609D532FECFFB57A57C939FDAE89854AF8F56160D575315E8393EAE025EFB040C687BFFE3448473304C7DABFC2E9C13
SSDEEP 3072:wyz+SHE9r2KOMsXiW7qWO9dSgiwdoCzDW:hq2Ktg7qWIdtdo

Signature

  • Status: The file C:\windows\SysWOW64\fsutil.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: fsutil.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.17031 (winblue_gdr.140221-1952)
  • Product Version: 6.3.9600.17031
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of fsutil.exe being misused. While fsutil.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_fsutil_symlinkevaluation.yml title: Fsutil Behavior Set SymlinkEvaluation DRL 1.0
sigma proc_creation_win_fsutil_symlinkevaluation.yml - https://docs.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior DRL 1.0
sigma proc_creation_win_fsutil_symlinkevaluation.yml Image\|endswith: fsutil.exe DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml title: Fsutil Suspicious Invocation DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml description: Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others). DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml Image\|endswith: '\fsutil.exe' DRL 1.0
sigma proc_creation_win_susp_fsutil_usage.yml OriginalFileName: 'fsutil.exe' DRL 1.0
sigma proc_creation_win_susp_spoolsv_child_processes.yml - \fsutil.exe DRL 1.0
atomic-red-team index.md - Atomic Test #1: Indicator Removal using FSUtil [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Indicator Removal using FSUtil [windows] MIT License. © 2018 Red Canary
atomic-red-team T1070.md - Atomic Test #1 - Indicator Removal using FSUtil MIT License. © 2018 Red Canary
atomic-red-team T1070.md ## Atomic Test #1 - Indicator Removal using FSUtil MIT License. © 2018 Red Canary
atomic-red-team T1070.md will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn MIT License. © 2018 Red Canary
atomic-red-team T1070.md fsutil usn deletejournal /D C: MIT License. © 2018 Red Canary
atomic-red-team T1070.md fsutil usn createjournal m=1000 a=100 c: MIT License. © 2018 Red Canary
signature-base crime_badrabbit.yar $s4 = “fsutil usn deletejournal /D %c:” fullword wide CC BY-NC 4.0
signature-base crime_nopetya_jun17.yar $x5 = “fsutil usn deletejournal /D %c:” fullword wide CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

fsutil

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, Windows 7

Performs tasks that are related to file allocation table (FAT) and NTFS file systems, such as managing reparse points, managing sparse files, or dismounting a volume. If it’s used without parameters, fsutil displays a list of supported subcommands.

[!NOTE] You must be logged on as an administrator or a member of the Administrators group to use fsutil. This command is quite powerful and should be used only by advanced users who have a thorough knowledge of Windows operating systems.

You must enable Windows Subsystem for Linux before you can run fsutil. Run the following command as Administrator in PowerShell to enable this optional feature:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux

You’ll be prompted to restart your computer once it’s installed. After your computer restarts, you’ll be able to run Fsutil as an administrator.

Parameters

Subcommand Description
fsutil 8dot3name Queries or changes the settings for short name behavior on the system, for example, generates 8.3 character-length file names. Removes short names for all files within a directory. Scans a directory and identifies registry keys that might be impacted if short names were stripped from the files in the directory.
fsutil dirty Queries whether the volume’s dirty bit is set or sets a volume’s dirty bit. When a volume’s dirty bit is set, autochk automatically checks the volume for errors the next time the computer is restarted.
fsutil file Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file’s short name, sets a file’s valid data length, sets zero data for a file, creates a new file of a specified size, finds a file ID if given the name, or finds a file link name for a specified file ID.
fsutil fsinfo Lists all drives and queries the drive type, volume information, NTFS-specific volume information, or file system statistics.
fsutil hardlink Lists hard links for a file, or creates a hard link (a directory entry for a file). Every file can be considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links, so a single file can appear in many directories (or even in the same directory, with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all links to it are deleted. After you create a hard link, programs can use it like any other file name.
fsutil objectid Manages object identifiers, which are used by the Windows operating system to track objects such as files and directories.
fsutil quota Manages disk quotas on NTFS volumes to provide more precise control of network-based storage. Disk quotas are implemented on a per-volume basis and enable both hard- and soft-storage limits to be implemented on a per-user basis.
fsutil repair Queries or sets the self-healing state of the volume. Self-healing NTFS attempts to correct corruptions of the NTFS file system online without requiring Chkdsk.exe to be run. Includes initiating on-disk verification and waiting for repair completion.
fsutil reparsepoint Queries or deletes reparse points (NTFS file system objects that have a definable attribute containing user-controlled data). Reparse points are used to extend functionality in the input/output (I/O) subsystem. They are used for directory junction points and volume mount points. They are also used by file system filter drivers to mark certain files as special to that driver.
fsutil resource Creates a Secondary Transactional Resource Manager, starts or stops a Transactional Resource Manager, displays information about a Transactional Resource Manager or modifies its behavior.
fsutil sparse Manages sparse files. A sparse file is a file with one or more regions of unallocated data in it. A program will see these unallocated regions as containing bytes with the value zero, but no disk space is used to represent these zeros. All meaningful or nonzero data is allocated, whereas all non-meaningful data (large strings of data composed of zeros) is not allocated. When a sparse file is read, allocated data is returned as stored and unallocated data is returned as zeros (by default in accordance with the C2 security requirement specification). Sparse file support allows data to be deallocated from anywhere in the file.
fsutil tiering Enables management of storage tier functions, such as setting and disabling flags and listing of tiers.
fsutil transaction Commits a specified transaction, rolls back a specified transaction, or displays info about the transaction.
fsutil usn Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume.
fsutil volume Manages a volume. Dismounts a volume, queries to see how much free space is available on a disk, or finds a file that is using a specified cluster.
fsutil wim Provides functions to discover and manage WIM-backed files.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.