Decrypt WannaCry With the Free WanaKiwi Tool

👁 0 views

[

How to Decrypt the WannaCry Virus With the Free WanaKiwi Tool

Requirements

– The computer has not been rebooted
– The data has not been tampered with before using this tool

Usage : wanakiwi.exe <PID>
– PID (Process Id) is an optional parameter. By default, wanakiwi automatically looks for the wnry.exe or wcry.exe process, so this parameter should not be needed. But if the main process has a different name, this parameter can be used as an input parameter.

UPDATE : Actually, wanakiwi from Benjamin Delpy (@gentilkiwi) works on both Windows XP (x86 ) and Windows 7 (x86 ) . This means it works on every version of Windows from XP to 7, including Windows 2003 (x86 ) , Vista, 2008 and 2008 R2.

Wannakey

Yesterday, Adrien Guinet published a tool called wannakey to recover the RSA key on Windows XP. His tool is very clever because it does not look for the actual key but for the prime numbers in memory to recompute the key itself. In short, his technique is totally badass and super smart.

Unfortunately, this only works on Windows XP because these values are cleaned up in CryptReleaseContext in later versions of Windows.

UPDATE : Forget the statement above, this has been successfully tested with wanakiwi on Windows 7.

As Adrien stated in his README, this is not a mistake by the ransomware author but an issue with Windows XP – the ransomware author definitely releases the user keys as soon as they are done with them. And that key never touches the disk unless it is encrypted with the attacker’s public key.

However, there were some file format issues with the exported key, which was not compatible with other tools such as wanadecrypt from Benjamin Delpy(@gentilkiwi) on Windows XP because the Windows Crypt APIs on Windows XP expect a very strict input, unlike Windows 10 . That is why my initial tests with the key output by Wannakey failed.

Moreover, the output file format is also not compatible with WannaCry itself. This is unlike Wanakiwi from gentilkiwi, as we can see in the demo below.

Wanakiwi

Download wanakiwi here
Wanakiwi.exe will automatically look for the 00000000.pky file – so don’t worry about that step anymore.

Wanakiwi also recreates the .dky files that the ransomware expects from the attackers, which makes it compatible with the ransomware itself. This also stops WannaCry from encrypting any more files.

WanaKiwi from Benjamin Delpy (@gentilkiwi) in action (Windows XP)

WanaKiwi from Benjamin Delpy (@gentilkiwi) in action (Windows 7)

What Comes Next?

As explained above, this method relies on finding the prime numbers in memory if the memory has not been reused – this means that after a certain amount of time, the memory may be reused and these prime numbers may be erased. Also, this means the infected computer should not have been restarted.

Also, so far this tool only works on Windows XP because of a current flaw in the CryptReleaseContext implementation. This is a big step forward.

UPDATE : Forget the statement above! This works from Windows XP to Windows 7, and as you can see in the screenshots above, it has been tested!

Today ( May 19 ) marks the 7th day of the infection ( which started on the 12th ) – meaning that many users will likely lose their files forever from today, as stated in the original infection window.

We noticed a significant and unusual spike in our sinkhole from Malaysia overnight ( 3 AM to 5 AM GST ), accounting for almost half of the 10,000 computers we prevented from being infected in the last 24 hours.