vssadmin.exe

  • File Path: C:\Windows\system32\vssadmin.exe
  • Description: Command Line Interface for Microsoft Volume Shadow Copy Service

Hashes

Type Hash
MD5 2964D232005BD840B38F9DB4F95DC7DB
SHA1 F1E0E3174F2F8E0347B214E7A7F9AE510F7FEFBA
SHA256 4FE71EB779B57354E5600DC31E3DC1875ADC8A06663654AEC83F11109751E8FC
SHA384 2CAF5B71C1A935F9FB717EE502AE2CDCCBDA5743550F3807BFC440BCB9DF654602C6C0EB90AB1EE98EB61B3744788164
SHA512 9267B32E5A5258BEA7E5A4CBD8C36F00663F66CB1A1B9FC410821828E22A492C4594182B76FBB84A3E90EE5DADC4ED5677C601726DA69C29C96995BC2DB83A20
SSDEEP 3072:JBhob1BDhkBj9kcVHE3nn0rvdj4m47paf7vP2Xor5f0g8JC5:rhK1BSBj9fHE3n0rVsm47p87vPCor5fs

Runtime Data

Usage (stdout):

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Error: Invalid command.
 
---- Commands Supported ----

Add ShadowStorage     - Add a new volume shadow copy storage association
Create Shadow         - Create a new volume shadow copy
Delete Shadows        - Delete volume shadow copies
Delete ShadowStorage  - Delete volume shadow copy storage associations
List Providers        - List registered volume shadow copy providers
List Shadows          - List existing volume shadow copies
List ShadowStorage    - List volume shadow copy storage associations
List Volumes          - List volumes eligible for shadow copies
List Writers          - List subscribed volume shadow copy writers
Resize ShadowStorage  - Resize a volume shadow copy storage association
Revert Shadow         - Revert a volume to a shadow copy
Query Reverts         - Query the progress of in-progress revert operations.

Signature

  • Status: Signature verified.
  • Serial: 33000000BCE120FDD27CC8EE930000000000BC
  • Thumbprint: E85459B23C232DB3CB94C7A56D47678F58E8E51E
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: VSSADMIN.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.14393.0 (rs1_release.160715-1616)
  • Product Version: 10.0.14393.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of vssadmin.exe being misused. While vssadmin.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma godmode_sigma_rule.yml - 'vssadmin delete shadows' # Ransomware DRL 1.0
sigma sysmon_suspicious_remote_thread.yml - '\vssadmin.exe' DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - https://www.trustwave.com/Resources/SpiderLabs-Blog/Tutorial-for-NTDS-goodness-(VSSADMIN,-WMIS,-NTDS-dit,-SYSTEM)/ DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - vssadmin.exe Delete Shadows DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - 'vssadmin create shadow /for=C:' DRL 1.0
sigma win_susp_vssadmin_ntds_activity.yml - 'vssadmin delete shadows /for=C:' DRL 1.0
sigma proc_creation_win_apt_hafnium.yml - 'vssadmin list shadows' DRL 1.0
sigma proc_creation_win_malware_conti.yml - 'vssadmin list shadows' DRL 1.0
sigma proc_creation_win_multiple_suspicious_cli.yml - vssadmin.exe DRL 1.0
sigma proc_creation_win_shadow_copies_creation.yml - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/ DRL 1.0
sigma proc_creation_win_shadow_copies_creation.yml - '\vssadmin.exe' DRL 1.0
sigma proc_creation_win_shadow_copies_deletion.yml - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ DRL 1.0
sigma proc_creation_win_shadow_copies_deletion.yml - '\vssadmin.exe' DRL 1.0
sigma proc_creation_win_shadow_copies_deletion.yml Image\|endswith: '\vssadmin.exe' DRL 1.0
sigma proc_creation_win_susp_system_user_anomaly.yml - 'vssadmin delete shadows' # Ransomware DRL 1.0
sigma proc_creation_win_webshell_detection.yml - '\vssadmin.exe' DRL 1.0
LOLBAS Wmic.yml - Command: wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit"  
atomic-red-team index.md - Atomic Test #1: Create Volume Shadow Copy with vssadmin [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #1: Create Volume Shadow Copy with vssadmin [windows] MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md - Atomic Test #1 - Create Volume Shadow Copy with vssadmin MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md ## Atomic Test #1 - Create Volume Shadow Copy with vssadmin MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md vssadmin.exe create shadow /for=#{drive_letter} MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md This test requires steps taken in the test “Create Volume Shadow Copy with vssadmin”. MIT License. © 2018 Red Canary
atomic-red-team T1003.003.md echo Run “Invoke-AtomicTest T1003.003 -TestName ‘Create Volume Shadow Copy with vssadmin’” to fulfill this requirement MIT License. © 2018 Red Canary
atomic-red-team T1490.md * vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet MIT License. © 2018 Red Canary
atomic-red-team T1490.md vssadmin.exe delete shadows /all /quiet MIT License. © 2018 Red Canary
atomic-red-team T1490.md if(!(vssadmin.exe list shadows | findstr “No items found that satisfy the query.”)) { exit 0 } else { exit 1 } MIT License. © 2018 Red Canary
atomic-red-team T1490.md vssadmin.exe create shadow /for=c: MIT License. © 2018 Red Canary
signature-base apt_grizzlybear_uscert.yar $b = “vssadmin delete shadows” ascii wide nocase CC BY-NC 4.0
signature-base crime_ransom_germanwiper.yar $KillShadowCopies = “vssadmin.exe delete shadows” ascii CC BY-NC 4.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


vssadmin

Applies to: Windows Server 2022, Windows Server 2019, Windows 10, Windows 8.1, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008

Displays current volume shadow copy backups and all installed shadow copy writers and providers. Select a command name in the following table view its command syntax.

Command Description Availability
vssadmin delete shadows Deletes volume shadow copies. Client and Server
vssadmin list shadows Lists existing volume shadow copies. Client and Server
vssadmin list writers Lists all subscribed volume shadow copy writers on the system. Client and Server
vssadmin resize shadowstorage Resizes the maximum size for a shadow copy storage association. Client and Server

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.