Utilizing Capa in Kali Linux for Wannacry Malware Identification and Analysis

Abstract

Purpose: This study aims to analyze the WannaCry ransomware using Kali Linux and the Common Access Platform Assistant (CAPA) method to provide a deeper understanding of the malware's attack tactics, capabilities, and behaviors. Methods/Study design/approach: The research was conducted by installing CAPA version 7.4.0 downloaded from GitHub, followed by file extraction and access permission configuration. The WannaCry malware was obtained from the "thezoo" repository on GitHub, extracted, and analyzed using CAPA commands in the Linux terminal. The analysis results were presented in tables showing the malware's tactics, techniques, and behaviors. Result/Findings: The analysis revealed that CAPA effectively identified various tactics and techniques used by WannaCry, confirming its classification as malware. Validation through antivirus services indicated that 68 out of 72 services flagged the file as malicious, emphasizing the importance of robust cybersecurity measures. Novelty/Originality/Value: This study offers new insights into the working mechanisms of WannaCry ransomware and highlights the effectiveness of the CAPA method in malware analysis. The findings contribute to a better understanding of cybersecurity threats and provide valuable information for professionals in the field to enhance defense strategies against malware.