manage-bde.exe

  • File Path: C:\Windows\system32\manage-bde.exe
  • Description: BitLocker Drive Encryption: Configuration Tool

Hashes

Type Hash
MD5 D44D57F5AAF9D5FD64EFC00C4761C304
SHA1 646B845F8C4DEE99ECEC859E57C238F48C747B44
SHA256 5BE37EAB49CEEE5C5245FD7C002672B0540C8F27AF74BB98E4CD109418B76150
SHA384 50F2993128E55F6FB366E9F509DE7FD373883DE0715EFF1079127D9AC75880CC63F70D775773B077D5FD30CD35323D33
SHA512 04A8984AC5540F65D050C0CC7C3EF88F1815C386ABF984DE55AA3193384A50B34A64F04D5078DBBA7CB0627C6B3476B389206DFAD0EF3A17AC66486953AC14E8
SSDEEP 6144:Ik4FMFSAh1fUVl7GF1uqq1/mcwVs7nyatGt+SYF:5FSESfWH+S+

Runtime Data

Usage (stdout):

BitLocker Drive Encryption: Configuration Tool version 10.0.17763
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

manage-bde[.exe] -parameter [arguments]

Description:
    Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
    -status     Provides information about BitLocker-capable volumes.
    -on         Encrypts the volume and turns BitLocker protection on.
    -off        Decrypts the volume and turns BitLocker protection off.
    -pause      Pauses encryption, decryption, or free space wipe.
    -resume     Resumes encryption, decryption, or free space wipe.
    -lock       Prevents access to BitLocker-encrypted data.
    -unlock     Allows access to BitLocker-encrypted data.
    -autounlock Manages automatic unlocking of data volumes.
    -protectors Manages protection methods for the encryption key.
    -SetIdentifier or -si
                Configures the identification field for a volume.
    -ForceRecovery or -fr
                Forces a BitLocker-protected OS to recover on restarts.
    -changepassword
                Modifies password for a data volume.
    -changepin  Modifies PIN for a volume.
    -changekey  Modifies startup key for a volume.
    -KeyPackage or -kp
                Generates a key package for a volume.
    -upgrade    Upgrades the BitLocker version.
    -WipeFreeSpace or -w
                Wipes the free space on the volume.
    -ComputerName or -cn
                Runs on another computer. Examples: "ComputerX", "127.0.0.1"
    -? or /?    Displays brief help. Example: "-ParameterSet -?"
    -Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
    manage-bde -status
    manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
    manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Loaded Modules:

Path
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\system32\manage-bde.exe
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 33000001C422B2F79B793DACB20000000001C4
  • Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: manage-bde.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.17763.1 (WinBuild.160101.0800)
  • Product Version: 10.0.17763.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 49
C:\WINDOWS\system32\baaupdate.exe 50
C:\windows\system32\baaupdate.exe 47
C:\WINDOWS\system32\baaupdate.exe 52
C:\Windows\system32\baaupdate.exe 49
C:\WINDOWS\system32\BdeHdCfg.exe 50
C:\Windows\system32\BdeHdCfg.exe 49
C:\WINDOWS\system32\BdeHdCfg.exe 47
C:\Windows\system32\BdeHdCfg.exe 47
C:\windows\system32\BdeHdCfg.exe 54
C:\Windows\system32\bdeunlock.exe 41
C:\Windows\system32\bdeunlock.exe 41
C:\WINDOWS\system32\bdeunlock.exe 38
C:\WINDOWS\system32\bdeunlock.exe 43
C:\windows\system32\bdeunlock.exe 43
C:\Windows\system32\bdeunlock.exe 41
C:\WINDOWS\system32\BitLockerWizard.exe 57
C:\Windows\system32\BitLockerWizard.exe 49
C:\windows\system32\BitLockerWizard.exe 54
C:\WINDOWS\system32\BitLockerWizard.exe 54
C:\Windows\system32\BitLockerWizard.exe 54
C:\Windows\system32\BitLockerWizard.exe 54
C:\Windows\system32\BitLockerWizardElev.exe 52
C:\Windows\system32\BitLockerWizardElev.exe 49
C:\WINDOWS\system32\BitLockerWizardElev.exe 52
C:\Windows\system32\BitLockerWizardElev.exe 49
C:\windows\system32\BitLockerWizardElev.exe 50
C:\WINDOWS\system32\BitLockerWizardElev.exe 52
C:\Windows\system32\fvecpl.dll 36
C:\Windows\system32\fvenotify.exe 46
C:\WINDOWS\system32\fvenotify.exe 49
C:\windows\system32\fvenotify.exe 52
C:\WINDOWS\system32\fvenotify.exe 49
C:\Windows\system32\fvenotify.exe 49
C:\WINDOWS\system32\fveprompt.exe 44
C:\Windows\system32\fveprompt.exe 54
C:\Windows\system32\fveprompt.exe 49
C:\WINDOWS\system32\fveprompt.exe 50
C:\windows\system32\fveprompt.exe 50
C:\Windows\system32\fveui.dll 43
C:\WINDOWS\system32\manage-bde.exe 57
C:\Windows\system32\manage-bde.exe 57
C:\WINDOWS\system32\manage-bde.exe 55
C:\windows\system32\manage-bde.exe 43
C:\Windows\system32\repair-bde.exe 55
C:\WINDOWS\system32\repair-bde.exe 50
C:\WINDOWS\system32\repair-bde.exe 50
C:\windows\system32\repair-bde.exe 52
C:\Windows\system32\repair-bde.exe 47

Possible Misuse

The following table contains possible examples of manage-bde.exe being misused. While manage-bde.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_manage_bde_lolbas.yml title: Suspicious Usage of the Manage-bde.wsf Script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml description: Detects a usage of the manage-bde.wsf script that may indicate an attempt of proxy execution from script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/Manage-bde.yml DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - 'manage-bde.wsf' DRL 1.0
LOLBAS Manage-bde.yml Name: Manage-bde.wsf  
LOLBAS Manage-bde.yml - Command: set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.  
LOLBAS Manage-bde.yml - Command: copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.  
LOLBAS Manage-bde.yml - Path: C:\Windows\System32\manage-bde.wsf  
LOLBAS Manage-bde.yml - IOC: Manage-bde.wsf should not be invoked by a standard user under normal situations  
atomic-red-team index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team T1216.md - Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md ## Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md Executes the signed manage-bde.wsf script with options to execute an arbitrary command. MIT License. © 2018 Red Canary
atomic-red-team T1216.md cscript %windir%\System32\manage-bde.wsf MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

manage-bde

Turns on or turns off BitLocker, specifies unlock mechanisms, updates recovery methods, and unlocks BitLocker-protected data drives.

[!NOTE] This command-line tool can be used in place of the BitLocker Drive Encryption Control Panel item.

Syntax

manage-bde [-status] [–on] [–off] [–pause] [–resume] [–lock] [–unlock] [–autounlock] [–protectors] [–tpm]
[–setidentifier] [-forcerecovery] [–changepassword] [–changepin] [–changekey] [-keypackage] [–upgrade] [-wipefreespace] [{-?|/?}] [{-help|-h}]

Parameters

Parameter Description
manage-bde status Provides information about all drives on the computer, whether or not they are BitLocker-protected.
manage-bde on Encrypts the drive and turns on BitLocker.
manage-bde off Decrypts the drive and turns off BitLocker. All key protectors are removed when decryption is complete.
manage-bde pause Pauses encryption or decryption.
manage-bde resume Resumes encryption or decryption.
manage-bde lock Prevents access to BitLocker-protected data.
manage-bde unlock Allows access to BitLocker-protected data with a recovery password or a recovery key.
manage-bde autounlock Manages automatic unlocking of data drives.
manage-bde protectors Manages protection methods for the encryption key.
manage-bde tpm Configures the computer’s Trusted Platform Module (TPM). This command isn’t supported on computers running Windows 8 or win8_server_2. To manage the TPM on these computers, use either the TPM Management MMC snap-in or the TPM Management cmdlets for Windows PowerShell.
manage-bde setidentifier Sets the drive identifier field on the drive to the value specified in the Provide the unique identifiers for your organization Group Policy setting.
manage-bde ForceRecovery Forces a BitLocker-protected drive into recovery mode on restart. This command deletes all TPM-related key protectors from the drive. When the computer restarts, only a recovery password or recovery key can be used to unlock the drive.
manage-bde changepassword Modifies the password for a data drive.
manage-bde changepin Modifies the PIN for an operating system drive.
manage-bde changekey Modifies the startup key for an operating system drive.
manage-bde KeyPackage Generates a key package for a drive.
manage-bde upgrade Upgrades the BitLocker version.
manage-bde WipeFreeSpace Wipes the free space on a drive.
-? or /? Displays brief Help at the command prompt.
-help or -h Displays complete Help at the command prompt.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.