manage-bde.exe

  • File Path: C:\WINDOWS\system32\manage-bde.exe
  • Description: BitLocker Drive Encryption: Configuration Tool

Hashes

Type Hash
MD5 E6577869DB69338E38173CD20C06A53E
SHA1 D8925B06749C57CAD0D0201AE3162D468F78BF70
SHA256 7F0315BDC3D6C92142FA5118538779B9749073335044A94E5C173DEA3858715A
SHA384 C679883DE0676487B0E049E72B2725E1A61C99C3212214B6BB3B7DBAB7C37B3CBAB06414B149BDBDC383349C8ACF68F8
SHA512 E4D17656502A2F9CEA79EADF8810398C8E15E460F9CF7D9235BA32BF2DED6A0CDF6494E4C21F8982E22D29673FAB3D8D8583052DBF9FF322A74EBC637A8C9FF5
SSDEEP 6144:aFF+OxBcNlpegjeeFGLyVG+15qq13/rcRCVs7nyatGt+SYF:aFFvPKO2vUUH+S+
IMP 407DEB72CE02369DD4B5A8ED2FF6A0B7
PESHA1 D1120B22C74DC0AB8290EDBE4528D18467F6DE97
PE256 CD8D13449E6D1F1C41FEA091F6C5E8BCC3713E9EBD6C060F43A92899CB68326C

Runtime Data

Usage (stdout):

BitLocker Drive Encryption: Configuration Tool version 10.0.22000
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

manage-bde[.exe] -parameter [arguments]

Description:
    Configures BitLocker Drive Encryption on disk volumes.

Parameter List:
    -status     Provides information about BitLocker-capable volumes.
    -on         Encrypts the volume and turns BitLocker protection on.
    -off        Decrypts the volume and turns BitLocker protection off.
    -pause      Pauses encryption, decryption, or free space wipe.
    -resume     Resumes encryption, decryption, or free space wipe.
    -lock       Prevents access to BitLocker-encrypted data.
    -unlock     Allows access to BitLocker-encrypted data.
    -autounlock Manages automatic unlocking of data volumes.
    -protectors Manages protection methods for the encryption key.
    -SetIdentifier or -si
                Configures the identification field for a volume.
    -ForceRecovery or -fr
                Forces a BitLocker-protected OS to recover on restarts.
    -changepassword
                Modifies password for a data volume.
    -changepin  Modifies PIN for a volume.
    -changekey  Modifies startup key for a volume.
    -KeyPackage or -kp
                Generates a key package for a volume.
    -upgrade    Upgrades the BitLocker version.
    -WipeFreeSpace or -w
                Wipes the free space on the volume.
    -ComputerName or -cn
                Runs on another computer. Examples: "ComputerX", "127.0.0.1"
    -? or /?    Displays brief help. Example: "-ParameterSet -?"
    -Help or -h Displays complete help. Example: "-ParameterSet -h"

Examples:
    manage-bde -status
    manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
    manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\system32\manage-bde.exe
C:\WINDOWS\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: manage-bde.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/7f0315bdc3d6c92142fa5118538779b9749073335044a94e5c173dea3858715a/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\baaupdate.exe 46
C:\WINDOWS\system32\baaupdate.exe 44
C:\windows\system32\baaupdate.exe 44
C:\WINDOWS\system32\baaupdate.exe 46
C:\Windows\system32\baaupdate.exe 46
C:\WINDOWS\system32\BdeHdCfg.exe 47
C:\Windows\system32\BdeHdCfg.exe 47
C:\WINDOWS\system32\BdeHdCfg.exe 44
C:\Windows\system32\BdeHdCfg.exe 44
C:\windows\system32\BdeHdCfg.exe 44
C:\Windows\system32\bdeunlock.exe 35
C:\Windows\system32\bdeunlock.exe 41
C:\WINDOWS\system32\bdeunlock.exe 38
C:\WINDOWS\system32\bdeunlock.exe 40
C:\windows\system32\bdeunlock.exe 41
C:\Windows\system32\bdeunlock.exe 40
C:\WINDOWS\system32\BitLockerWizard.exe 43
C:\Windows\system32\BitLockerWizard.exe 43
C:\windows\system32\BitLockerWizard.exe 46
C:\WINDOWS\system32\BitLockerWizard.exe 49
C:\Windows\system32\BitLockerWizard.exe 43
C:\Windows\system32\BitLockerWizard.exe 49
C:\Windows\system32\BitLockerWizardElev.exe 52
C:\Windows\system32\BitLockerWizardElev.exe 43
C:\WINDOWS\system32\BitLockerWizardElev.exe 46
C:\Windows\system32\BitLockerWizardElev.exe 49
C:\windows\system32\BitLockerWizardElev.exe 44
C:\WINDOWS\system32\BitLockerWizardElev.exe 46
C:\Windows\system32\fvecpl.dll 38
C:\Windows\system32\fvenotify.exe 41
C:\WINDOWS\system32\fvenotify.exe 41
C:\windows\system32\fvenotify.exe 46
C:\WINDOWS\system32\fvenotify.exe 41
C:\Windows\system32\fvenotify.exe 49
C:\WINDOWS\system32\fveprompt.exe 44
C:\Windows\system32\fveprompt.exe 47
C:\Windows\system32\fveprompt.exe 41
C:\WINDOWS\system32\fveprompt.exe 40
C:\windows\system32\fveprompt.exe 47
C:\Windows\system32\fveui.dll 38
C:\WINDOWS\system32\manage-bde.exe 49
C:\Windows\system32\manage-bde.exe 49
C:\Windows\system32\manage-bde.exe 55
C:\windows\system32\manage-bde.exe 44
C:\Windows\system32\repair-bde.exe 46
C:\WINDOWS\system32\repair-bde.exe 41
C:\WINDOWS\system32\repair-bde.exe 44
C:\windows\system32\repair-bde.exe 46
C:\Windows\system32\repair-bde.exe 43

Possible Misuse

The following table contains possible examples of manage-bde.exe being misused. While manage-bde.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_manage_bde_lolbas.yml title: Suspicious Usage of the Manage-bde.wsf Script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml description: Detects a usage of the manage-bde.wsf script that may indicate an attempt of proxy execution from script DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/Manage-bde.yml DRL 1.0
sigma proc_creation_win_manage_bde_lolbas.yml - 'manage-bde.wsf' DRL 1.0
LOLBAS Manage-bde.yml Name: Manage-bde.wsf  
LOLBAS Manage-bde.yml - Command: set comspec=c:\windows\system32\calc.exe & cscript c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Set the comspec variable to another executable prior to calling manage-bde.wsf for execution.  
LOLBAS Manage-bde.yml - Command: copy c:\users\person\evil.exe c:\users\public\manage-bde.exe & cd c:\users\public\ & cscript.exe c:\windows\system32\manage-bde.wsf  
LOLBAS Manage-bde.yml Description: Run the manage-bde.wsf script with a payload named manage-bde.exe in the same directory to run the payload file.  
LOLBAS Manage-bde.yml - Path: C:\Windows\System32\manage-bde.wsf  
LOLBAS Manage-bde.yml - IOC: Manage-bde.wsf should not be invoked by a standard user under normal situations  
atomic-red-team index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #2: manage-bde.wsf Signed Script Command Execution [windows] MIT License. © 2018 Red Canary
atomic-red-team T1216.md - Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md ## Atomic Test #2 - manage-bde.wsf Signed Script Command Execution MIT License. © 2018 Red Canary
atomic-red-team T1216.md Executes the signed manage-bde.wsf script with options to execute an arbitrary command. MIT License. © 2018 Red Canary
atomic-red-team T1216.md cscript %windir%\System32\manage-bde.wsf MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

manage-bde

Turns on or turns off BitLocker, specifies unlock mechanisms, updates recovery methods, and unlocks BitLocker-protected data drives.

[!NOTE] This command-line tool can be used in place of the BitLocker Drive Encryption Control Panel item.

Syntax

manage-bde [-status] [–on] [–off] [–pause] [–resume] [–lock] [–unlock] [–autounlock] [–protectors] [–tpm]
[–setidentifier] [-forcerecovery] [–changepassword] [–changepin] [–changekey] [-keypackage] [–upgrade] [-wipefreespace] [{-?|/?}] [{-help|-h}]

Parameters

Parameter Description
manage-bde status Provides information about all drives on the computer, whether or not they are BitLocker-protected.
manage-bde on Encrypts the drive and turns on BitLocker.
manage-bde off Decrypts the drive and turns off BitLocker. All key protectors are removed when decryption is complete.
manage-bde pause Pauses encryption or decryption.
manage-bde resume Resumes encryption or decryption.
manage-bde lock Prevents access to BitLocker-protected data.
manage-bde unlock Allows access to BitLocker-protected data with a recovery password or a recovery key.
manage-bde autounlock Manages automatic unlocking of data drives.
manage-bde protectors Manages protection methods for the encryption key.
manage-bde tpm Configures the computer’s Trusted Platform Module (TPM). This command isn’t supported on computers running Windows 8 or win8_server_2. To manage the TPM on these computers, use either the TPM Management MMC snap-in or the TPM Management cmdlets for Windows PowerShell.
manage-bde setidentifier Sets the drive identifier field on the drive to the value specified in the Provide the unique identifiers for your organization Group Policy setting.
manage-bde ForceRecovery Forces a BitLocker-protected drive into recovery mode on restart. This command deletes all TPM-related key protectors from the drive. When the computer restarts, only a recovery password or recovery key can be used to unlock the drive.
manage-bde changepassword Modifies the password for a data drive.
manage-bde changepin Modifies the PIN for an operating system drive.
manage-bde changekey Modifies the startup key for an operating system drive.
manage-bde KeyPackage Generates a key package for a drive.
manage-bde upgrade Upgrades the BitLocker version.
manage-bde WipeFreeSpace Wipes the free space on a drive.
-? or /? Displays brief Help at the command prompt.
-help or -h Displays complete Help at the command prompt.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.