Deletes Windows Defender Definitions

Uses mpcmdrun utility to delete all AV definitions.

Zhen Ransomware

First seen in September 2020. Drops ransomnote as .ini file.

Executes dropped EXE

Modifies WinLogon to allow AutoLogon

Enables rebooting of the machine without requiring login credentials.

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.

Possible privilege escalation attempt