TrendLabs: Account With Admin Privileges Abused to Install BitPaymer Ransomware via PsExec

Figure 1. Timeline of events that led to the execution of the BitPaymer ransomware variant

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/account-with-admin-privileges-abused-to-install-bitpaymer-ransomware-via-psexec/