Here's how it's done:
How To Decrypt Files From WannaCry
First, download the tool from GitHub at:
https://github.com/gentilkiwi/wanakiwi
—ideally on a machine that is free infection.
Extract the .zip file to a folder on your desktop. If you downloaded it on a machine other than the one hit by WannaCry, move the file to a USB drive and run it on the infected computer from the drive.
Open the tool by double clicking on it. Wanakiwi will begin searching the machine for the process tied to WannaCry. If they are named
wnry.exe or
wcry.exe, the tool should find them automatically.
If the tool can’t find WannaCry, it may be possible to manually identify the offending process by opening the Task Manager. This can be done by pressing Control + Alt + Delete on the keyboard. If there is a file that appears related to WannaCry, get the Process Identification Number (PID) and plug it into the command prompt after “wanakiwi.exe” to direct the tool to the ransomware.
Once the tool knows what it is targeting, it will begin searching for the decryption key. It does this by searching the system’s memory for prime numbers and piecing together the key used by the ransomware. The rest should be automatic; once Wanakiwi has the encrpytion key, it will decrypt the ransomed files on its own.
Once it is finished, users are advised to run an antivirus tool to remove any artifacts of WannaCry that may still be present on their system. To be safe, users may want to create backups of their most important files, wipe the machine and perform a fresh install of their operating system.
Wanakiwi doesn’t work 100 percent of the time—much of its success is dependent on timing, as it relies on reading the memory of the system at the time of the infection.
If the system is restarted or too many processes have been run since the infection, the encryption key might be lost or overwritten by data from other applications. But the tool does provide some hope for those who may still be plagued by ransomware.