Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)

Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. <code>C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL</code>).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. 

In addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its  <code>/HMODULE</code> command-line parameter (ex. <code>mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER</code>). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)
Mavinject
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1218/013  external_id: T1218.013     source_name: ATT Lazarus TTP Evolution  description: Fernando Martinez. (2021, July 6). Lazarus campaign TTPs and evolution. Retrieved September 22, 2021.  url: https://cybersecurity.att.com/blogs/labs-research/lazarus-campaign-ttps-and-evolution     source_name: LOLBAS Mavinject  description: LOLBAS. (n.d.). Mavinject.exe. Retrieved September 22, 2021.  url: https://lolbas-project.github.io/lolbas/Binaries/Mavinject/     source_name: Mavinject Functionality Deconstructed  description: Matt Graeber. (2018, May 29). mavinject.exe Functionality Deconstructed. Retrieved September 22, 2021.  url: https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e     source_name: Reaqta Mavinject  description: Reaqta. (2017, December 16). From False Positive to True Positive: the story of Mavinject.exe, the Microsoft Injector. Retrieved September 22, 2021.  url: https://reaqta.com/2017/12/mavinject-microsoft-injector/     