Unable to morph - traceback error

[pranavperfect]

Using default generated powershell HTA from Cobalt Strike 3.14 (Release May 4, 2019). Getting the following error:

[vysecurity]

May depend on the type of launch method. I’ll revisit shortly.

On Tue, 13 Aug 2019 at 23:56, Pranav Sharma [email protected] wrote:

Using default generated powershell HTA from Cobalt Strike 3.14 (Release May 4, 2019). Getting the following error:

[image: Screenshot from 2019-08-13 11-51-40] https://user-images.githubusercontent.com/20574960/62956644-4f670480-bdc1-11e9-99ec-c3d9d4a3d66d.png

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/vysecurity/morphHTA/issues/3?email_source=notifications&email_token=AA3N7UU6YGK23WWRCWP2S4LQELKRFA5CNFSM4ILMJBCKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4HE72SGA, or mute the thread https://github.com/notifications/unsubscribe-auth/AA3N7URT3R4K5FLL2EB7M73QELKRFANCNFSM4ILMJBCA .

[VirtualAlllocEx]

Hello, I also tried it a few times to morph a evil.hta generated with Cobalt Strike 3.14. Is there already any solution? THX

[vysecurity]

It still works IMO?

[RubyistCTRLDYT]

It still works IMO?

Nope ～ I got the same problem here

[chef42]

Any update on this issue? Thx for help :)

[Pascal-0x90]

The solution to this is in the evil.hta, you must include .exe to the end of powershell within the hta.