manage-bde.exe

  • File Path: C:\Windows\system32\manage-bde.exe
  • Description: BitLocker Drive Encryption: Configuration Tool

Hashes

Type Hash
MD5 84021D418863A3E530D2E3F65F5D154C
SHA1 4EEE495D9121CB6BB510A1298E209B175454B1AD
SHA256 38F20A75E04BB9A53C563152A90A5B29AB689AFF58D6ABD3E005D156EE4E4C73
SHA384 E82F9D96B62FBB7494F9329F3C8F288270A517D0268BBAE8AC6EE4B1B134A35EBBA20EBB86898B9C9EAF9781CEEE7F5F
SHA512 AEDCC746BF543DB4BB7529F5C2FF678DFC386AC53A7A0D1E51A3B46FBD62BB7455A0630E1EAAA73CD73CB1D340DF65677CF3CACB261619C636CDD073842B4B75
SSDEEP 6144:9sZ+OW0m5L6kLZc87GF1lqq1Bmt5Vs7nyatGt+SYF:9snWBhPS8lH+S+
IMP 817DDC8CC4FA183F801D96706E452A3B
PESHA1 28814B26EC2F640FC2F9B5E26C562169730D57CA
PE256 030975587F4448F60B3B9BCE4F92EBFCE17F8ED1DE0BFEB4A34EA27AC01CE5E2

Runtime Data

Usage (stdout):

BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

manage-bde[.exe] -parameter [arguments]

Description:
    Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
    -status     Provides information about BitLocker-capable volumes.
    -on         Encrypts the volume and turns BitLocker protection on.
    -off        Decrypts the volume and turns BitLocker protection off.
    -pause      Pauses encryption, decryption, or free space wipe.
    -resume     Resumes encryption, decryption, or free space wipe.
    -lock       Prevents access to BitLocker-encrypted data.
    -unlock     Allows access to BitLocker-encrypted data.
    -autounlock Manages automatic unlocking of data volumes.
    -protectors Manages protection methods for the encryption key.
    -SetIdentifier or -si
                Configures the identification field for a volume.
    -ForceRecovery or -fr
                Forces a BitLocker-protected OS to recover on restarts.
    -changepassword
                Modifies password for a data volume.
    -changepin  Modifies PIN for a volume.
    -changekey  Modifies startup key for a volume.
    -KeyPackage or -kp
                Generates a key package for a volume.
    -upgrade    Upgrades the BitLocker version.
    -WipeFreeSpace or -w
                Wipes the free space on the volume.
    -ComputerName or -cn
                Runs on another computer. Examples: "ComputerX", "127.0.0.1"
    -? or /?    Displays brief help. Example: "-ParameterSet -?"
    -Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
    manage-bde -status
    manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
    manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\manage-bde.exe
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: manage-bde.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/38f20a75e04bb9a53c563152a90a5b29ab689aff58d6abd3e005d156ee4e4c73/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 54
C:\WINDOWS\system32\baaupdate.exe 49
C:\windows\system32\baaupdate.exe 49
C:\WINDOWS\system32\baaupdate.exe 50
C:\Windows\system32\baaupdate.exe 50
C:\WINDOWS\system32\BdeHdCfg.exe 52
C:\Windows\system32\BdeHdCfg.exe 47
C:\WINDOWS\system32\BdeHdCfg.exe 49
C:\Windows\system32\BdeHdCfg.exe 49
C:\windows\system32\BdeHdCfg.exe 47
C:\Windows\system32\bdeunlock.exe 40
C:\Windows\system32\bdeunlock.exe 36
C:\WINDOWS\system32\bdeunlock.exe 40
C:\WINDOWS\system32\bdeunlock.exe 38
C:\windows\system32\bdeunlock.exe 46
C:\Windows\system32\bdeunlock.exe 40
C:\WINDOWS\system32\BitLockerWizard.exe 47
C:\Windows\system32\BitLockerWizard.exe 47
C:\windows\system32\BitLockerWizard.exe 50
C:\WINDOWS\system32\BitLockerWizard.exe 50
C:\Windows\system32\BitLockerWizard.exe 50
C:\Windows\system32\BitLockerWizard.exe 50
C:\Windows\system32\BitLockerWizardElev.exe 54
C:\Windows\system32\BitLockerWizardElev.exe 47
C:\WINDOWS\system32\BitLockerWizardElev.exe 50
C:\Windows\system32\BitLockerWizardElev.exe 47
C:\windows\system32\BitLockerWizardElev.exe 49
C:\WINDOWS\system32\BitLockerWizardElev.exe 54
C:\Windows\system32\fvecpl.dll 38
C:\Windows\system32\fvenotify.exe 50
C:\WINDOWS\system32\fvenotify.exe 47
C:\windows\system32\fvenotify.exe 47
C:\WINDOWS\system32\fvenotify.exe 41
C:\Windows\system32\fvenotify.exe 47
C:\WINDOWS\system32\fveprompt.exe 50
C:\Windows\system32\fveprompt.exe 47
C:\Windows\system32\fveprompt.exe 44
C:\WINDOWS\system32\fveprompt.exe 44
C:\windows\system32\fveprompt.exe 46
C:\Windows\system32\fveui.dll 41
C:\WINDOWS\system32\manage-bde.exe 58
C:\Windows\system32\manage-bde.exe 57
C:\WINDOWS\system32\manage-bde.exe 49
C:\windows\system32\manage-bde.exe 50
C:\Windows\system32\repair-bde.exe 46
C:\WINDOWS\system32\repair-bde.exe 52
C:\WINDOWS\system32\repair-bde.exe 49
C:\windows\system32\repair-bde.exe 50
C:\Windows\system32\repair-bde.exe 46

Possible Misuse

The following table contains possible examples of manage-bde.exe being misused. While manage-bde.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_manage_bde_lolbas.yml title: Suspicious Usage of the Manage-bde.wsf Script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml description: Detects a usage of the manage-bde.wsf script that may indicate an attempt of proxy execution from script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/Manage-bde.yml DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - 'manage-bde.wsf' DRL 1.0
LOLBAS Manage-bde.yml Name: Manage-bde.wsf  
LOLBAS Manage-bde.yml - Command: set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.  
LOLBAS Manage-bde.yml - Command: copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.  
LOLBAS Manage-bde.yml - Path: C:\Windows\System32\manage-bde.wsf  
LOLBAS Manage-bde.yml - IOC: Manage-bde.wsf should not be invoked by a standard user under normal situations  
atomic-red-team index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team T1216.md - Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md ## Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md Executes the signed manage-bde.wsf script with options to execute an arbitrary command. MIT License. © 2018 Red Canary
atomic-red-team T1216.md cscript %windir%\System32\manage-bde.wsf MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

manage-bde

Turns on or turns off BitLocker, specifies unlock mechanisms, updates recovery methods, and unlocks BitLocker-protected data drives.

[!NOTE] This command-line tool can be used in place of the BitLocker Drive Encryption Control Panel item.

Syntax

manage-bde [-status] [–on] [–off] [–pause] [–resume] [–lock] [–unlock] [–autounlock] [–protectors] [–tpm]
[–setidentifier] [-forcerecovery] [–changepassword] [–changepin] [–changekey] [-keypackage] [–upgrade] [-wipefreespace] [{-?|/?}] [{-help|-h}]

Parameters

Parameter Description
manage-bde status Provides information about all drives on the computer, whether or not they are BitLocker-protected.
manage-bde on Encrypts the drive and turns on BitLocker.
manage-bde off Decrypts the drive and turns off BitLocker. All key protectors are removed when decryption is complete.
manage-bde pause Pauses encryption or decryption.
manage-bde resume Resumes encryption or decryption.
manage-bde lock Prevents access to BitLocker-protected data.
manage-bde unlock Allows access to BitLocker-protected data with a recovery password or a recovery key.
manage-bde autounlock Manages automatic unlocking of data drives.
manage-bde protectors Manages protection methods for the encryption key.
manage-bde tpm Configures the computer’s Trusted Platform Module (TPM). This command isn’t supported on computers running Windows 8 or win8_server_2. To manage the TPM on these computers, use either the TPM Management MMC snap-in or the TPM Management cmdlets for Windows PowerShell.
manage-bde setidentifier Sets the drive identifier field on the drive to the value specified in the Provide the unique identifiers for your organization Group Policy setting.
manage-bde ForceRecovery Forces a BitLocker-protected drive into recovery mode on restart. This command deletes all TPM-related key protectors from the drive. When the computer restarts, only a recovery password or recovery key can be used to unlock the drive.
manage-bde changepassword Modifies the password for a data drive.
manage-bde changepin Modifies the PIN for an operating system drive.
manage-bde changekey Modifies the startup key for an operating system drive.
manage-bde KeyPackage Generates a key package for a drive.
manage-bde upgrade Upgrades the BitLocker version.
manage-bde WipeFreeSpace Wipes the free space on a drive.
-? or /? Displays brief Help at the command prompt.
-help or -h Displays complete Help at the command prompt.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.