{
  "family": "fakeransom",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Ransomware:Win32/Fakeransom (or 'Scareware') refers to malicious programs that mimic the behavior and appearance of actual ransomware to extort money, but lack the capability to actually encrypt the victim's files (`T1491`). They rely entirely on psychological manipulation and screen-locking techniques rather than cryptographic damage.<br><br><b>Understanding Fakeransom (Scareware)</b><br>To an end-user, Fakeransom is terrifying. A full-screen window appears, claiming their files have been encrypted by a notorious cartel (like WannaCry or Ryuk) or locked by the FBI/Interpol for 'illegal activity', demanding immediate payment in Bitcoin or gift cards. For an incident responder, discovering the infection is 'fake' is a massive relief, as data recovery is usually trivial and requires no decryption key.<br><br><b>Execution and Screen-Locking Mechanics</b><br>Fakeransom is often distributed via malvertising, drive-by downloads, or bundled with pirated software. Upon execution, it does not encrypt files. Instead, it employs Screen Locking techniques (`T1491.002`). It maximizes a borderless window, sets it to always be 'on top', and disables the Task Manager (`taskmgr.exe`), the Windows key, and Alt+Tab functionality via API hooking (`T1562.001`). This traps the average user on the extortion screen, convincing them that their machine is hopelessly compromised.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is psychological distress and potential financial loss if the user pays the ransom. Data availability is only temporarily affected by the screen lock. Host-based IoCs include the presence of the full-screen extortion window, registry modifications disabling the Task Manager (`DisableTaskMgr=1`), and a persistent executable running from `%AppData%` or `%Temp%`. Network IoCs may include connections to the attacker's payment portal, but unlike real ransomware, there is no transmission of encryption keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1491.002",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.002",
      "name": "Defacement: Internal Defacement (Creating a full-screen, unclosable ransom note)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Disabling Task Manager and system shortcuts to trap the user)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Common distribution method via deceptive ads)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Boot the infected computer into 'Safe Mode with Command Prompt' to bypass the screen-locking application.",
    "Use the command prompt to launch `regedit.exe` and remove the persistence mechanism (usually a Run key) and re-enable the Task Manager.",
    "Delete the Fakeransom executable from the file system.",
    "Run a comprehensive anti-malware scan to ensure no other, silent threats were dropped alongside the scareware."
  ],
  "what_to_avoid": [
    "Under no circumstances should the ransom be paid; the files are not encrypted, and payment only encourages further extortion.",
    "Avoid reinstalling the entire operating system, as this is usually unnecessary for non-encrypting scareware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}