I am doing some research about Ransomware and their methods. In many articles they write that the ransomware performs vssadmin.exe to delete shadow copys. And I found following Information about how they bypass the problem that admin privileges are needed:
"As this program (vssadmin.exe) requires Administrative privileges to run, some ransomware will inject themselves into processes that are running as an Administrator in order to avoid a UAC prompt from being displayed."
My question is, how do they inject themselves into those processes? Any Links or Information about this would be great.