Security Analysis of Ransomware: A Deep Dive into WannaCry and Locky

Ransomware has become a major threat to businesses, leading to significant financial losses and reputational damage. In this paper, we analyzed two distinct and sophisticated ransomware families, WannaCry and Locky, using both static and dynamic analysis. For Locky, due to its capability of potentially escaping out of the virtual testing environment and infecting the host device in the latest variants, we chose to analyze several other variants of Locky in our experiment. Our research findings highlight each ransomware family's unique characteristics and behavior, including their encryption methods and propagation techniques. Additionally, we examine the similarities and differences between the two families, providing insights into their evolution and potential future developments. This paper contributes to the growing knowledge of ransomware and provides a deeper understanding of these malicious programs' threats to businesses and individuals. Our deep study and analysis of WannaCry and Locky can also help the security community develop more effective cybersecurity countermeasures and mitigation solutions to combat these growing cyber threats.