Record any observed symptoms of infection from initial detonation. What are the main symptoms of a WannaCry infection?
Encryption of all the files 🥵
Use FLOSS and extract the strings from the main WannaCry binary. Are there any strings of interest?
<http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com>
Inspect the import address table for the main WannaCry binary. Are there any notable API imports?
What conditions are necessary to get this sample to detonate?
Network Indicators: Identify the network indicators of this malware
Host-based Indicators: Identify the host-based indicators of this malware.
Use Cutter to locate the killswitch mechanism in the decompiled code and explain how it functions.
