{
  "family": "hoax",
  "sample_count": 48,
  "category": "ransomware",
  "description": "Hoax (cataloged across security vendors and threat intelligence databases under detections including Trojan-Ransom.Win32.Hoax, Ransom:Win32/Hoax, and Scareware.Hoax) is a landmark family of deceptive scareware, rogue security software, and fake ransomware active since 2008. Unlike crypto-ransomware that performs cryptographic file encryption, Hoax relies on social engineering and deceptive system locking. Upon execution, the malware displays fabricated system warnings claiming the host has been seized by law enforcement agencies (such as the FBI, Interpol, or Department of Justice) or contaminated with hundreds of critical viruses. The trojan locks down the Windows desktop, blocks access to Task Manager (taskmgr.exe), the Registry Editor (regedit.exe), and the Command Prompt (cmd.exe), and demands payment via prepaid money cards (such as Ukash, Paysafecard, or Moneypak) to unlock the machine.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Ransom.Win32.Hoax",
    "Ransom:Win32/Hoax",
    "Scareware.Hoax",
    "Win32/Hoax",
    "FakeAV.Hoax"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Hoax?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hoax is a scareware and fake ransomware family that locks the computer screen with false legal threats demanding ransom."
      }
    },
    {
      "@type": "Question",
      "name": "Does Hoax actually encrypt personal files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, Hoax is a non-encrypting screen locker (Winlocker) that intimidates users with fabricated legal warnings."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hoax prevent users from opening Task Manager?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies Windows registry policies to disable taskmgr.exe, regedit.exe, and administrative command consoles."
      }
    },
    {
      "@type": "Question",
      "name": "What payment methods were demanded by Hoax variants?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It demanded voucher codes from prepaid payment services like Ukash, Paysafecard, and GreenDot Moneypak."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be recovered from a Hoax infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Safe Mode or an offline recovery environment, restore the DisableTaskMgr registry value, and delete the binary."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1562.001",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1491",
      "name": "Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to prevent the Hoax software from communicating with its affiliate payment servers.",
    "Boot the infected machine into Safe Mode; this often bypasses the persistence mechanisms of trivial scareware, allowing for manual removal.",
    "Audit the Windows Registry and remove any policies designed to restrict user actions (e.g., restoring access to the Task Manager).",
    "If the user provided credit card information to the fake software, advise them to contact their bank immediately to dispute the fraudulent charges."
  ],
  "what_to_avoid": [
    "Do not pay the requested fee; the software is fraudulent and the 'premium' version provides no actual security.",
    "Avoid assuming the machine is clean just because the pop-ups stopped; the underlying adware framework must be fully uninstalled."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion via Intimidation Scareware",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "Malicious Adware Pop-Ups",
    "Fake Video Codec Prompts",
    "Deceptive Online Antivirus Scanners"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP",
    "Windows 8"
  ],
  "capabilities": [
    "Fullscreen Desktop Lockdown",
    "Task Manager Disablement (DisableTaskMgr)",
    "Fabricated Police / FBI Warning Display",
    "Registry Editor Suppression (DisableRegistryTools)",
    "Startup Shell Hijacking"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Standalone Screen Locker"
    ],
    "network_signatures": [
      "HTTP POST beacons validating entered voucher payment card numbers against operator servers"
    ],
    "evasion_techniques": [
      "Disabling Windows administrative tools and keyboard combinations",
      "Hooking desktop window focus to prevent alt-tabbing away from the ransom warning",
      "Hiding the Windows taskbar and start button"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\hoax_lock.exe",
        "%SystemRoot%\\fbi_warning.exe"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Rogue FakeAV / Winlocker Ecosystem"
    ],
    "variants": [
      "Hoax.FBI",
      "Hoax.Ukash",
      "Hoax.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "aa11bb22cc33dd44ee55ff6677889900aabbccddeeff11223344556677889900",
      "bb22cc33dd44ee55ff6677889900aabbccddeeff11223344556677889900aabb"
    ],
    "delivery": [
      "fbi_fine_notice_player.exe",
      "codec_vlc_security_patch.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HoaxLock"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Ransom:Win32/Hoax",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Hoax"
    },
    {
      "name": "Kaspersky Securelist - The Anatomy of Police Winlockers",
      "url": "https://securelist.com"
    }
  ]
}