NtCreateProcessEx failed! Status: c00000bb [OS-22621]

[Lioncky]

Modern Windows seems deny this way to create process,
Using NtCreateUserProcess instead

https://www.huntandhackett.com/blog/concealed-code-execution-techniques-and-detection
https://github.com/huntandhackett/process-cloning

NtCreateProcessEx failed! Status: c00000bb
[-] Failed!

[pygmon]

I have encountered the same issue, and it also occurs in Process Herpaderping. Have you resolved it now?

[Lioncky]

Have you resolved it now?

Yes, as I said

[CaptWake]

This issue seems to be related to Windows Code Integrity (CI) policies. To confirm that, if you disable the Verified and Reputable Policy by setting the following registry value to 0 it should work.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
"VerifiedAndReputablePolicyState"=dword:00000000