We have a weird problem on 2 PCs with running a digitally signed 120 Mb executable.
If user launches a digitally signed .exe - then the launching host (e.g. Explorer or cmd.exe) will enter infinite (endless) cycle constantly opening/closing HKLM\System\CurrentControlSet\Control\Cryptography\Providers and HKLM\System\CurrentControlSet\Control\Cryptography\Configuration registry keys. The call stack indicate that host process is sitting inside CreateProcess function (more specifically - inside NtCreateUserProcess), and the target process is "partially created". E.g. it is visible in Task Manager, but there is no "Process created" event in Process Monitor, and any attempt to open target process will hang the tool which attempts to open it.
The launch process for Explorer/CMD goes like this:
- Checking HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Image File Execution Options (not exists)
- Reading entire .exe by 32 Kb chunks
- Reading registry keys under HKLM\System\CurrentControlSet\Control\Cryptography\ and enumerating HKLM+HCU\SOFTWARE\MICROSOFT\SystemCertificates\Disallowed\Certificates
- Endless cycle with reading the above mentioned registry keys starts right after ending enumeration of HKU.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
The digital certificate is a usual SHA1-RSA certificate for code signing issued by COMODO. Signed executable is time-stamped. The problem is not in a particular executable, as all other executables signed with this certificate have the same issue. Other signed executables seems to run OK.
What we have tried:
- File hash is OK.
- Both PCs have MalwareBytes installed.
- Disabling anti-virus and firewall does not solve the issue.
- Safe mode solves the issue.
- Certificate is OK, not expired, not revoked, certutil -f -urlfetch -verify does not find any issue.
- Certificate's hash is not listed in the above mentioned enumerations of various Disallowed\Certificates registry keys.
- Uninstalling MS14-066/KB2992611 does not help.