.WNRY File

A file with a WNRY extension has been encrypted by WannaCry ransomware (also known as WannaCrypt0r, WannaCrypt, and WCry), which is malware utilized by cybercriminals. It contains a file, such as an .MP4, .DOCX, .MPG, .BAK, or .PDF file, that has been renamed and encrypted by the virus. WNRY files became prevalent in 2017 and are variants of the .WCRY and .WNCRY encrypted files.

The purpose of the WannaCry virus is to take a user's files hostage then force the user to pay the cybercriminals (by way of bitcoin) to unlock his files. The virus is primarily spread via phishing spam emails designed to coax the victim into opening a malicious email attachment. Once the virus affects a user's computer it begins scrambling his files, renaming them, and encrypting them. It appends the WNRY extension onto the file extension. For example, a user's example.xlsx file becomes example.xlsx.wnry. The virus then generates a .TXT ransom note informing the user of the takeover and what the user needs to do to recover his files.

NOTE: There is no program currently available to effectively restore WNRY files. If a user backed up his files he can execute a full system restore.