RID Hijacking Technique Utilized by Andariel Attack Group

AhnLab ASEC describes Andariel's use of RID Hijacking to escalate privileges and persist: attackers obtain SYSTEM (e.g., via PsExec/JuicyPotato), create a hidden account (name ending with '$'), change the account's RID in HKEY_LOCAL_MACHINE\SAM to match an administrator, export and re-import registry keys to minimize visibility, and in some cases use regini to adjust SAM permissions; the report includes behavioral commands, a comparison between a malicious sample and an open-source tool, and an MD5 hash for the sample.