has changed memory protection permissions then overwritten in memory DLL function code with shellcode which was later executed via  hijacking.  has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.(Citation: Lazarus APT January 2022)
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: has changed memory protection permissions then overwritten in memory DLL function code with shellcode which was later executed via  hijacking.  has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.(Citation: Lazarus APT January 2022) ### Response: T1620.