Wannakey vs Competitors: Which One Wins?
Overview
Wannakey (by Adrien Guinet) is a specialized decryptor developed during the May 2017 WannaCry outbreak. It attempts to recover RSA private-key primes left in process memory to decrypt files on infected Windows systems without paying ransom. Key competitors/related tools include Wanakiwi (Benjamin Delpy), other decryptors like Wanadecrypt, and commercial/academic recovery solutions.
How Wannakey works
- Approach: Scans running memory of an infected system for leftover RSA prime numbers generated by WannaCry’s use of Windows Crypto APIs.
- Target platforms: Originally effective on Windows XP, 7, 2003, Vista and Server 2008 (limited by memory artifacts).
- Requirements: The infected machine must still be running wcry.exe (no reboot) and memory must not have been overwritten by post-infection activity.
Competitors / Alternatives
- Wanakiwi (Delpy): Builds on Wannakey methods, broader OS support (includes some Windows ⁄2008 R2 cases), improved automation and user-friendliness. Often the go-to tool after Wannakey.
- Wanadecrypt / other open-source decryptors: Earlier/later tools addressing specific variants; effectiveness varies by variant and OS.
- Commercial recovery/services: Forensic services and some antivirus vendors offered paid assistance or tools; may combine memory forensics and backups to recover data.
- Academic/tools like PayBreak: Research projects that attempt key recovery across ransomware families; not always practical for end users.
Strengths and Weaknesses
-
Wannakey — Strengths
- Free, open-source, created quickly by researchers.
- Effective in specific, real-world cases where memory artifacts remained.
-
Wannakey — Weaknesses
- Narrow window of opportunity (machine must be running, low post-infection activity).
- Limited automation and OS coverage versus later tools.
- Not effective after reboot or extensive system activity.
-
Wanakiwi — Strengths
- More robust and automated; broader OS compatibility.
- Incorporates improvements based on Wannakey’s method.
-
Wanakiwi — Weaknesses
- Same fundamental limitation: depends on memory artifacts; not a universal fix.
-
Commercial/Forensic services — Strengths
- Professional handling, safer procedures, possible recovery when DIY tools fail.
-
Commercial — Weaknesses
- Costly and no guaranteed recovery.
Practical verdict
- If you have a currently infected, un-rebooted Windows system with minimal activity: try Wanakiwi first (most user-friendly and broadly effective), then Wannakey if needed. Both offer a reasonable chance to recover files without paying ransom, but success is conditional.
- If the machine has been rebooted, heavily used, or runs an unsupported OS/version: these memory-based tools are unlikely to work—seek professional forensic help or restore from backups.
Recommendation (step-by-step)
- Immediately isolate the infected machine from networks (do not reboot).
- If using a Windows XP/7/Server 2008 family machine with running wcry.exe, run Wanakiwi (preferred) or Wannakey on a forensic copy or directly if instructed by a trusted guide.
- If recovery fails or you’re unsure, contact a reputable forensic/incident-response service.
- Restore from backups and patch SMB/EternalBlue vulnerabilities to prevent reinfection.
Bottom line
Wannakey was an important, timely tool that proved the memory-recovery approach works in practice. Wanakiwi improved on it and is generally the preferred first choice. Neither is a guaranteed solution—success depends on system state—so backups and proper incident response remain the winning strategy.