wusa.exe

  • File Path: C:\windows\SysWOW64\wusa.exe
  • Description: Windows Update Standalone Installer

Screenshot

wusa.exe

Hashes

Type Hash
MD5 F3EF56F76D69361022B47EF1E6201644
SHA1 8E3913A7085E596A9CC45F2B6A4795B9C3FEEF6C
SHA256 1E384E490AFF301349D27C37139D304EDC83CF62571875540AB468E3B0D65C06
SHA384 D07A979713A1EBBAF3D8B08A7B5F1A1A713C61420BED449A1064E80F41C839FEFFC223B124BED55C4FA1AA816A4D2080
SHA512 E8EA9D8981A4EF86EB52782ED5CBF23E55FD9E2F3BB7DB59391271E91E48FD06875A89C448FEA005B7D9969BCA579D228EC157154EB5C6CA8B7FFA2ADFC5B6DB
SSDEEP 6144:eK8nRccM6pf5XvrFMU2AGGpxyN90vE/5:D8nRcepxXzyyfy90C5

Signature

  • Status: The file C:\windows\SysWOW64\wusa.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: wusa.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\WINDOWS\system32\wusa.exe 38
C:\Windows\system32\wusa.exe 41
C:\WINDOWS\system32\wusa.exe 38
C:\windows\system32\wusa.exe 41
C:\Windows\system32\wusa.exe 33
C:\Windows\system32\wusa.exe 32
C:\Windows\system32\wusa.exe 36
C:\Windows\SysWOW64\wusa.exe 52
C:\Windows\SysWOW64\wusa.exe 50
C:\Windows\SysWOW64\wusa.exe 50
C:\WINDOWS\SysWOW64\wusa.exe 43
C:\Windows\SysWOW64\wusa.exe 50
C:\WINDOWS\SysWOW64\wusa.exe 49

Possible Misuse

The following table contains possible examples of wusa.exe being misused. While wusa.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma file_event_win_uac_bypass_ntfs_reparse_point.yml description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) DRL 1.0
sigma proc_creation_win_uac_bypass_ntfs_reparse_point.yml description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36) DRL 1.0
sigma proc_creation_win_uac_bypass_ntfs_reparse_point.yml CommandLine\|startswith: '"C:\Windows\system32\wusa.exe" /quiet C:\Users\' DRL 1.0
signature-base apt_thrip.yar $s5 = “wusa.exe” fullword ascii CC BY-NC 4.0
signature-base apt_thrip.yar $s4 = “wusa.exe” fullword ascii CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.