NtSetVolumeInformationFile

Prototype

NTSTATUS NtSetVolumeInformationFile(
  HANDLE                 FileHandle,
  PIO_STATUS_BLOCK       IoStatusBlock,
  PVOID                  FsInformation,
  ULONG                  Length,
  FS_INFORMATION_CLASS   FsInformationClass
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 C4 01 00 00      mov eax, 0x1C4
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

Far rarer than its `Query` sibling because the FS_INFORMATION_CLASS values that filesystems actually accept on the `Set` path are limited: `FileFsLabelInformation` (rename the volume), `FileFsControlInformation` (quota policy on NTFS), and `FileFsObjectIdInformation` (NTFS object-id assignment). Most other classes return `STATUS_INVALID_INFO_CLASS`. The IRP routes through `IRP_MJ_SET_VOLUME_INFORMATION` and reaches NTFS at `NtfsFsdSetVolumeInformation`. Renaming a volume requires `SE_MANAGE_VOLUME_NAME` privilege, which is held by interactive administrators and `LocalSystem` — not by standard users — so use of this syscall from a non-admin context is itself unusual telemetry.

Common malware usage

Niche but visible. A handful of ransomware families — most notoriously **Petya/NotPetya** (2017, MBR-encrypter) and some **Babuk** / **DarkSide** affiliates — issue `FileFsLabelInformation` to overwrite the volume name with their brand or a `READ_ME_*` string, so that any pre-boot recovery screen or `dir C:\` shows the ransom marker before the user opens the note. **BlackMatter** (2021) renamed labels to a short hash matching its ransom ID. Beyond ransomware the call is essentially unused by commodity malware — there is no offensive primitive here, only branding.

Detection opportunities

Microsoft Defender for Endpoint surfaces label changes via `DeviceEvents` ActionType `VolumeMounted` / `VolumeRenamed`. Sysmon does *not* cover this directly but ETW `Microsoft-Windows-Kernel-File` IRP traces show `IRP_MJ_SET_VOLUME_INFORMATION` with class 2 (`FileFsLabelInformation`). Because the privileged path is so narrow, *any* `NtSetVolumeInformationFile(FileFsLabelInformation)` from a non-trusted process — anything that is not `explorer.exe`, `cmd.exe label`, `format.com`, or a known backup product — should be considered high-confidence ransomware indication, especially when chained with `NtQueryVolumeInformationFile` enumeration of all drive letters seconds earlier.

Direct syscall examples

; Direct syscall stub for NtSetVolumeInformationFile (SSN 0x1C4 on Win11 24H2 / Server 2025)
NtSetVolumeInformationFile PROC
    mov  r10, rcx          ; syscall convention
    mov  eax, 1C4h         ; SSN — drifts; resolve dynamically for portability
    syscall
    ret
NtSetVolumeInformationFile ENDP

// Requires SE_MANAGE_VOLUME_NAME privilege. Petya/NotPetya stamped
// volume labels with their ransom marker — visible in pre-boot UI.
#include <ntstatus.h>

typedef struct _FILE_FS_LABEL_INFORMATION {
    ULONG VolumeLabelLength;        // bytes, not chars
    WCHAR VolumeLabel[1];
} FILE_FS_LABEL_INFORMATION;

WCHAR  label[] = L"READ_ME_NOW";
SIZE_T bytes   = sizeof(label) - sizeof(WCHAR);
BYTE   buf[sizeof(FILE_FS_LABEL_INFORMATION) + sizeof(label)];
FILE_FS_LABEL_INFORMATION* p = (FILE_FS_LABEL_INFORMATION*)buf;
p->VolumeLabelLength = (ULONG)bytes;
memcpy(p->VolumeLabel, label, bytes);

IO_STATUS_BLOCK iosb;
NTSTATUS st = NtSetVolumeInformationFile(
    hVolumeRoot, &iosb, p,
    (ULONG)(sizeof(FILE_FS_LABEL_INFORMATION) + bytes),
    2 /* FileFsLabelInformation */);

// Cargo: windows-sys = "0.59" (Win32_Storage_FileSystem)
use windows_sys::Win32::Storage::FileSystem::SetVolumeLabelW;
use std::ffi::OsStr;
use std::os::windows::ffi::OsStrExt;

// Internally calls NtSetVolumeInformationFile(FileFsLabelInformation).
fn relabel(root: &str, label: &str) -> bool {
    let to_wide = |s: &str| -> Vec<u16> { OsStr::new(s).encode_wide().chain(Some(0)).collect() };
    let r = to_wide(root);
    let l = to_wide(label);
    unsafe { SetVolumeLabelW(r.as_ptr(), l.as_ptr()) != 0 }
}

MITRE ATT&CK mappings

• T1486Data Encrypted for Impactmitre ↗
• T1491.001Internal Defacementmitre ↗
• T1106Native APImitre ↗