3

The relevant files for this question are here:

https://cubiclesoft.com/Unrelated/32_pe_msmpeng_test.zip

Contains a before and after DLL. This simple PHP script demonstrates the problem:

<?php
    $ts = microtime(true);
    file_put_contents("test.dll", file_get_contents("32_pe_msmpeng_before.dll"));
    echo "Time taken:  " . sprintf("%.02f", microtime(true) - $ts) . " sec\n";
    unlink("test.dll");

    $ts = microtime(true);
    file_put_contents("test.dll", file_get_contents("32_pe_msmpeng_after.dll"));
    echo "Time taken:  " . sprintf("%.02f", microtime(true) - $ts) . " sec\n";
    unlink("test.dll");
?>

The output looks like:

>php test.php
Time taken:  0.00 sec
Time taken:  4.14 sec

The only difference between the two DLLs is that the certificate table has been removed and the PE checksum has been updated in the "after" DLL. The 4 second delay is caused by MsMpEng.exe using 100% of one core of a CPU during that time. MsMpEng.exe is the main Windows Defender realtime scanning engine. The files are not flagged as malware but the behavior is bizarre in that simply removing the certificate table would trigger a deep scan.

The original file was modified using my Windows PE File Tools for PHP and these commands:

php pe_tools.php modify clear-certs 32_pe_msmpeng_before.dll 32_pe_msmpeng_after.dll

php pe_tools.php modify apply-checksum 32_pe_msmpeng_after.dll 32_pe_msmpeng_after.dll

I've checked the "after" file in every conceivable way I can think of and it appears to be completely valid to all of the tools I've used. I've also modified plenty of other PE files without tripping up the realtime scanner. Just this file causes the time delay and spike in CPU usage and that only happens after the certificate table is removed. I can make all kinds of other crazy changes to the file that should immediately result in an invalid certificate table (e.g. adding a new PE section, embedding icons, etc) and it won't trip up the realtime scanner either. But remove the certificate table entirely and that 4 second delay + 100% CPU in MsMpEng.exe appears. This behavior seems to imply that just having a certificate table possibly bypasses portions or even, um, all of Windows Defender...

But that's not really the question. What I'd like to know is what exactly is in the "after" DLL that is causing MsMpEng.exe to conduct a deep scan that takes upwards of 4 seconds to complete?

  • Might be certificate revocation list check that times out (do you have internet access?). Windows Defender is single threaded btw – Remko Nov 20 '19 at 21:38
  • If there isn't a Certificate Table, there isn't a CRL to check against because there's no certificate. The 4 second delay happens when there is no Certificate Table not when there is one. But to answer the question, yes, I have Internet access. – CubicleSoft Nov 21 '19 at 0:48
  • As I understood it: with the certificate table it's slow and without it's not? Or did you mean to say it's the other way round? – Remko Nov 22 '19 at 14:09
  • 1
    Try pausing the windows defender process with a debugger while it's doing the 4 second thing then look at the call stacks in the various threads? – Avery3R Nov 22 '19 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.