AhnLab ASEC blog (asec.ahnlab.com)
Case of Injection Attack Using Legitimate MS Utility mavinject.exe · 2025-04-15
excerpt: 1. Overview Mavinject.exe is a legitimate utility provided by Microsoft. It is used to inject DLLs into specific processes in an Application Virtualization (App-V) environment. It has been included in the operating system by default since Windows 10 version 1607, and it is a trusted executable file signed by Microsoft. As a result, most security […] | attribution sentence: Case 2: Lazarus Group’s explorer.exe Injection Technique Lazarus is a threat group that mainly uses document-based malware distribution techniques. | target sentence: The following are the key Windows APIs called internally when it runs: OpenProcess: Retrieves a handle to the target process, requiring the PROCESS_VM_OPERATION, PROCESS_VM_WRITE, and PROCESS_CREATE_THREAD permissions.