Wannacry Identification For Computer Data Security

Abstract

The purpose of this study is, to find out the features of the wanscry ransomware that have not been run and extract the Windows computer data system from wannacry in the scope of an interconnection network. To find out the behavior of wannacry ransomware after running on a Windows computer system and knowing how to use the ransomware

The method used in this research is Surface Analysis, Static Analysis, Runtime Analysis, and Intrusion Detection System. The research was carried out in the umsida informatics laboratory, data collection information about wannacry  through  journals,  ebooks,  and  the  internet.  Identification   techniques  are  carried  out  before ransomware is run on the system Windows operation, and after running.

The conclusion of this study is to identify the characteristics  of wannacry ransomware outside with software strings,  graphics,  and  to  identify  in  depth  with  the  OllyDbg,  IdaPro  software,  and  to  identify  when  the ransomware  is  run  the  software  used  by  TcpView,  Procmon,  ProcessExplore.  Determine  the  exploitation technique  of wannacry  spread on computer systems.  Along with ways to prevent the spread of infections in computer systems and networks using microtics