2

We have a weird problem on 2 PCs with running a digitally signed 120 Mb executable.

If user launches a digitally signed .exe - then the launching host (e.g. Explorer or cmd.exe) will enter infinite (endless) cycle constantly opening/closing HKLM\System\CurrentControlSet\Control\Cryptography\Providers and HKLM\System\CurrentControlSet\Control\Cryptography\Configuration registry keys. The call stack indicate that host process is sitting inside CreateProcess function (more specifically - inside NtCreateUserProcess), and the target process is "partially created". E.g. it is visible in Task Manager, but there is no "Process created" event in Process Monitor, and any attempt to open target process will hang the tool which attempts to open it.

The launch process for Explorer/CMD goes like this:

  1. Checking HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Image File Execution Options (not exists)
  2. Reading entire .exe by 32 Kb chunks
  3. Reading registry keys under HKLM\System\CurrentControlSet\Control\Cryptography\ and enumerating HKLM+HCU\SOFTWARE\MICROSOFT\SystemCertificates\Disallowed\Certificates
  4. Endless cycle with reading the above mentioned registry keys starts right after ending enumeration of HKU.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates

The digital certificate is a usual SHA1-RSA certificate for code signing issued by COMODO. Signed executable is time-stamped. The problem is not in a particular executable, as all other executables signed with this certificate have the same issue. Other signed executables seems to run OK.

What we have tried:

  1. File hash is OK.
  2. Both PCs have MalwareBytes installed.
  3. Disabling anti-virus and firewall does not solve the issue.
  4. Safe mode solves the issue.
  5. Certificate is OK, not expired, not revoked, certutil -f -urlfetch -verify does not find any issue.
  6. Certificate's hash is not listed in the above mentioned enumerations of various Disallowed\Certificates registry keys.
  7. Uninstalling MS14-066/KB2992611 does not help.

Any ideas?

1

We found the reason for this.

It is indeed a problem with Malwarebytes tool. Its driver (mbamchameleon.sys) injects into CreateProcess call and cause infinite loop during check for digital signature of some signed executables.

https://support.eurekalog.com/index.php?/Knowledgebase/Article/View/67/4/installer-hangs-on-launch

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.