Identifier / Programs / Windows

mavinject.exe

Microsoft Application Virtualization Injector file version info (xCyclopedia)

LOLBAS Execute, ADS 2 ATT&CK techniques 2 documented commands 16 known copies with hashes

How mavinject.exe is abused

documented by LOLBAS

Execute T1218.013 System Binary Proxy Execution: Mavinject

-injectrunning

ADS T1564.004 Hide Artifacts: NTFS File Attributes

-injectrunning

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for mavinject.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218.013 System Binary Proxy Execution: Mavinject User privileges

Inject evil.dll into a process with PID 3110.

MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}

Identify

Trips 1 Sigma rule: highRenamed Mavinject.EXE Execution by frack113, Florian Roth

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172

Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll

Identify

Trips 1 Sigma rule: highRenamed Mavinject.EXE Execution by frack113, Florian Roth

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for mavinject.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for mavinject.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1218.013System Binary Proxy Execution: Mavinject

T1564.004Hide Artifacts: NTFS File Attributes

Is it the real mavinject.exe?

file version info and known copies

Original namemavinject64.exe in the file’s header: a renamed copy still carries it

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft Application Virtualization Injector

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mavinject.exe · signed by Microsoft Windows

3a645ffdeff126b43d641bb2a6121909f01018c7ba709b2f5e4880143457e55d

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mavinject.exe · signed by Microsoft Windows

ff1bd8083bc74ba555bd8bbcf39e364039dd1493e72e1f09e33169a09665ef88

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mavinject.exe · signed by Microsoft Windows

765ee5f458ab9254ade24caa3321411f625f959ed380851476fddb9652ec963f

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\system32\mavinject.exe · signed by Microsoft Windows

930272da382accb872cd2f4be045beaac493cd1a896786e4fb4b42f30e1d9a32

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mavinject.exe · signed by Microsoft Windows

4d27af387d4a9475add1bf427b2fa0e9420f7d85dfcf4285734d400a531ab758

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\mavinject.exe · signed by Microsoft Windows

59f8e38b825d4c2d00d7384639b77c4083df30956e9f197f83d37c933bb7091e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mavinject.exe · signed by Microsoft Windows

1c1a5bf6bc7ec24c67f2a13e5c8eb71c927927545f8eb7a75f1a4ea893604c38

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mavinject.exe · signed by Microsoft Windows

bd4d2aea5385982d180c36077ecfc007ce65c5b41aabae97239643ee940858a3

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mavinject.exe · signed by Microsoft Windows

6e9918e42caf13b96bfa46fd6d8d89edbecda575bdc2dc0a7f082bc6deb30a06

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mavinject.exe · signed by Microsoft Windows

926b54d54dec971022bd18f97ab970d4533b34a1cef9c65dca1b696c1119cd90

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mavinject.exe · signed by Microsoft Windows

784bbc33e7db4bb5b680bd22ea330b094884a639cd156ada576a45dc85f92174

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\system32\mavinject.exe · signed by Microsoft Windows

bef978f32a3e9582cdb86770509925cb9ddc797c7f6a2055ab2702c6d57302d9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mavinject.exe · signed by Microsoft Windows

1a4b1740610c61f1efe390ef5632b89566e35a381558bb609921d2606361b9be

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mavinject.exe · signed by Microsoft Windows

abb99f7cfd3e9eb294501aafa082a8d4841278cc39a4fb3dff9942ca1f71a139

10.0.14393.3659 (rs1_release_1.200410-1813) · C:\Windows\SysWOW64\mavinject.exe · signed by Microsoft Windows

18af462a5ee58bf8bfa175ba734ce91b48e28c7859ca57ab18b5948d1a4b35dd

10.0.14393.3659 (rs1_release_1.200410-1813) · C:\Windows\system32\mavinject.exe · signed by Microsoft Windows

cfbca5dde322dd0cc6dd07412589b532b59302d4d7b1739be248f9cdd24cd8e6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.