{
  "family": "hoax",
  "sample_count": 48,
  "category": "ransomware",
  "description": "Hoax:Win32/Hoax is a broad heuristic classification applied by antivirus engines to identify deceptive software programs, commonly known as scareware, fake antivirus (Rogue AV), or tech support scams, which utilize psychological manipulation to extort money from users.<br><br><b>Understanding Hoax (Scareware)</b><br>To the end-user, a Hoax infection is terrifying. Their screen is locked with flashing, official-looking warnings claiming their computer is severely infected with hundreds of viruses or that illegal activity was detected. For security analysts, Hoax is a purely social engineering attack. The malware itself is often technically trivial; it does not actually encrypt files or steal data. Its sole purpose is to frighten the user into paying for a fake 'premium version' to remove the non-existent threats, or to call a fraudulent tech support hotline.<br><br><b>Execution and Evasion Strategies</b><br>Hoax software is typically distributed via malicious advertisements (malvertising), drive-by downloads, or bundled with pirated software. Upon execution, it aggressively modifies the user interface. It may replace the desktop wallpaper, disable the Task Manager (`T1562.001`) to prevent the user from closing the fake warnings, and add persistence via the Registry Run keys. It continuously displays fraudulent scanning progress bars and exaggerated threat counts (`T1491`). The software is designed to be highly visible and difficult for a layperson to terminate.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss if the user falls for the scam, and significant helpdesk ticket volume. Incident responders will observe a machine flooded with intrusive, fake UI elements. EDR logs will show the executable aggressively modifying registry keys designed to restrict user actions (e.g., `DisableTaskMgr`, `DisableRegistryTools`). Unlike true ransomware, the files on the hard drive remain unencrypted and accessible if the fake UI can be bypassed.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1491",
    "T1547.001",
    "T1562.001",
    "T1059.003",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491",
      "name": "Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to prevent the Hoax software from communicating with its affiliate payment servers.",
    "Boot the infected machine into Safe Mode; this often bypasses the persistence mechanisms of trivial scareware, allowing for manual removal.",
    "Audit the Windows Registry and remove any policies designed to restrict user actions (e.g., restoring access to the Task Manager).",
    "If the user provided credit card information to the fake software, advise them to contact their bank immediately to dispute the fraudulent charges."
  ],
  "what_to_avoid": [
    "Do not pay the requested fee; the software is fraudulent and the 'premium' version provides no actual security.",
    "Avoid assuming the machine is clean just because the pop-ups stopped; the underlying adware framework must be fully uninstalled."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}