manage-bde.exe

  • File Path: C:\WINDOWS\system32\manage-bde.exe
  • Description: BitLocker Drive Encryption: Configuration Tool

Hashes

Type Hash
MD5 146C56E1598A4F568B6F0342A485DD84
SHA1 B49C5B846CB0BF31612A4357B7BD4647F4C71641
SHA256 7C4D5E3CE3B97EBF2533C8529789EE4B1FCB846C95D21DCC9EC87EB1309A5BC9
SHA384 A684AF67831592564E6FCC00AC0493F0B4728B152D2BE841E783FA5A1F0B0723008D337349C790F5FF25C26EB1BAC3D8
SHA512 9486B32CA343BFA76DD6369B040CE317F56BBCCA6E4706EC81FAD80E1E4A4037AB3607B5A77DF135104DECDB952D098BDF192C6F94AF0CC048801939B4F662B9
SSDEEP 6144:bo2xdPdE8j77GF1Gqq1PmToVs7nyatGt+SYF:E2xdPL6OH+S+

Runtime Data

Usage (stdout):

BitLocker Drive Encryption: Configuration Tool version 10.0.18362
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

manage-bde[.exe] -parameter [arguments]

Description:
    Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
    -status     Provides information about BitLocker-capable volumes.
    -on         Encrypts the volume and turns BitLocker protection on.
    -off        Decrypts the volume and turns BitLocker protection off.
    -pause      Pauses encryption, decryption, or free space wipe.
    -resume     Resumes encryption, decryption, or free space wipe.
    -lock       Prevents access to BitLocker-encrypted data.
    -unlock     Allows access to BitLocker-encrypted data.
    -autounlock Manages automatic unlocking of data volumes.
    -protectors Manages protection methods for the encryption key.
    -SetIdentifier or -si
                Configures the identification field for a volume.
    -ForceRecovery or -fr
                Forces a BitLocker-protected OS to recover on restarts.
    -changepassword
                Modifies password for a data volume.
    -changepin  Modifies PIN for a volume.
    -changekey  Modifies startup key for a volume.
    -KeyPackage or -kp
                Generates a key package for a volume.
    -upgrade    Upgrades the BitLocker version.
    -WipeFreeSpace or -w
                Wipes the free space on the volume.
    -ComputerName or -cn
                Runs on another computer. Examples: "ComputerX", "127.0.0.1"
    -? or /?    Displays brief help. Example: "-ParameterSet -?"
    -Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
    manage-bde -status
    manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
    manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: manage-bde.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.18362.1 (WinBuild.160101.0800)
  • Product Version: 10.0.18362.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 55
C:\WINDOWS\system32\baaupdate.exe 54
C:\windows\system32\baaupdate.exe 54
C:\WINDOWS\system32\baaupdate.exe 50
C:\Windows\system32\baaupdate.exe 55
C:\WINDOWS\system32\BdeHdCfg.exe 54
C:\Windows\system32\BdeHdCfg.exe 49
C:\WINDOWS\system32\BdeHdCfg.exe 54
C:\Windows\system32\BdeHdCfg.exe 49
C:\windows\system32\BdeHdCfg.exe 49
C:\Windows\system32\bdeunlock.exe 44
C:\Windows\system32\bdeunlock.exe 46
C:\WINDOWS\system32\bdeunlock.exe 41
C:\WINDOWS\system32\bdeunlock.exe 44
C:\windows\system32\bdeunlock.exe 41
C:\Windows\system32\bdeunlock.exe 41
C:\WINDOWS\system32\BitLockerWizard.exe 52
C:\Windows\system32\BitLockerWizard.exe 57
C:\windows\system32\BitLockerWizard.exe 57
C:\WINDOWS\system32\BitLockerWizard.exe 57
C:\Windows\system32\BitLockerWizard.exe 57
C:\Windows\system32\BitLockerWizard.exe 52
C:\Windows\system32\BitLockerWizardElev.exe 55
C:\Windows\system32\BitLockerWizardElev.exe 55
C:\WINDOWS\system32\BitLockerWizardElev.exe 58
C:\Windows\system32\BitLockerWizardElev.exe 50
C:\windows\system32\BitLockerWizardElev.exe 57
C:\WINDOWS\system32\BitLockerWizardElev.exe 55
C:\Windows\system32\fvecpl.dll 41
C:\Windows\system32\fvenotify.exe 47
C:\WINDOWS\system32\fvenotify.exe 49
C:\windows\system32\fvenotify.exe 50
C:\WINDOWS\system32\fvenotify.exe 47
C:\Windows\system32\fvenotify.exe 50
C:\WINDOWS\system32\fveprompt.exe 58
C:\Windows\system32\fveprompt.exe 52
C:\Windows\system32\fveprompt.exe 54
C:\WINDOWS\system32\fveprompt.exe 44
C:\windows\system32\fveprompt.exe 49
C:\Windows\system32\fveui.dll 41
C:\Windows\system32\manage-bde.exe 58
C:\Windows\system32\manage-bde.exe 57
C:\WINDOWS\system32\manage-bde.exe 49
C:\windows\system32\manage-bde.exe 50
C:\Windows\system32\repair-bde.exe 61
C:\WINDOWS\system32\repair-bde.exe 49
C:\WINDOWS\system32\repair-bde.exe 54
C:\windows\system32\repair-bde.exe 55
C:\Windows\system32\repair-bde.exe 49

Possible Misuse

The following table contains possible examples of manage-bde.exe being misused. While manage-bde.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_manage_bde_lolbas.yml title: Suspicious Usage of the Manage-bde.wsf Script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml description: Detects a usage of the manage-bde.wsf script that may indicate an attempt of proxy execution from script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/Manage-bde.yml DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - 'manage-bde.wsf' DRL 1.0
LOLBAS Manage-bde.yml Name: Manage-bde.wsf  
LOLBAS Manage-bde.yml - Command: set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.  
LOLBAS Manage-bde.yml - Command: copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.  
LOLBAS Manage-bde.yml - Path: C:\Windows\System32\manage-bde.wsf  
LOLBAS Manage-bde.yml - IOC: Manage-bde.wsf should not be invoked by a standard user under normal situations  
atomic-red-team index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team T1216.md - Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md ## Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md Executes the signed manage-bde.wsf script with options to execute an arbitrary command. MIT License. © 2018 Red Canary
atomic-red-team T1216.md cscript %windir%\System32\manage-bde.wsf MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

manage-bde

Turns on or turns off BitLocker, specifies unlock mechanisms, updates recovery methods, and unlocks BitLocker-protected data drives.

[!NOTE] This command-line tool can be used in place of the BitLocker Drive Encryption Control Panel item.

Syntax

manage-bde [-status] [–on] [–off] [–pause] [–resume] [–lock] [–unlock] [–autounlock] [–protectors] [–tpm]
[–setidentifier] [-forcerecovery] [–changepassword] [–changepin] [–changekey] [-keypackage] [–upgrade] [-wipefreespace] [{-?|/?}] [{-help|-h}]

Parameters

Parameter Description
manage-bde status Provides information about all drives on the computer, whether or not they are BitLocker-protected.
manage-bde on Encrypts the drive and turns on BitLocker.
manage-bde off Decrypts the drive and turns off BitLocker. All key protectors are removed when decryption is complete.
manage-bde pause Pauses encryption or decryption.
manage-bde resume Resumes encryption or decryption.
manage-bde lock Prevents access to BitLocker-protected data.
manage-bde unlock Allows access to BitLocker-protected data with a recovery password or a recovery key.
manage-bde autounlock Manages automatic unlocking of data drives.
manage-bde protectors Manages protection methods for the encryption key.
manage-bde tpm Configures the computer’s Trusted Platform Module (TPM). This command isn’t supported on computers running Windows 8 or win8_server_2. To manage the TPM on these computers, use either the TPM Management MMC snap-in or the TPM Management cmdlets for Windows PowerShell.
manage-bde setidentifier Sets the drive identifier field on the drive to the value specified in the Provide the unique identifiers for your organization Group Policy setting.
manage-bde ForceRecovery Forces a BitLocker-protected drive into recovery mode on restart. This command deletes all TPM-related key protectors from the drive. When the computer restarts, only a recovery password or recovery key can be used to unlock the drive.
manage-bde changepassword Modifies the password for a data drive.
manage-bde changepin Modifies the PIN for an operating system drive.
manage-bde changekey Modifies the startup key for an operating system drive.
manage-bde KeyPackage Generates a key package for a drive.
manage-bde upgrade Upgrades the BitLocker version.
manage-bde WipeFreeSpace Wipes the free space on a drive.
-? or /? Displays brief Help at the command prompt.
-help or -h Displays complete Help at the command prompt.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.