2

I am doing some research about Ransomware and their methods. In many articles they write that the ransomware performs vssadmin.exe to delete shadow copys. And I found following Information about how they bypass the problem that admin privileges are needed:

"As this program (vssadmin.exe) requires Administrative privileges to run, some ransomware will inject themselves into processes that are running as an Administrator in order to avoid a UAC prompt from being displayed."

My question is, how do they inject themselves into those processes? Any Links or Information about this would be great.

3

There are many process injection techniques, there is no standard way used in all ransomware.

Some of these techniques:

  • Classic Dll Injection Via Createremotethread And Loadlibrary.
  • Portable Executable Injection (Pe Injection) Process Hollowing (A.K.A Process Replacement And Runpe)
  • Thread Execution Hijacking (A.K.A Suspend, Inject, And Resume (Sir))
  • Hook Injection Via Setwindowshookex
  • Injection And Persistence Via Registry Modificatio (E.G. Appinit_Dlls, Appcertdlls, Ifeo)
  • Apc Injection And Atombombing
  • Extra Window Memory Injection (Ewmi) Via Setwindowlong
  • Injection Using Shims Iat Hooking And Inline Hooking (A.K.A Userland Rootkits)

The following link describes all of the above techniques.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.