Modifies Windows Defender Real-time Protection settings

Disables Task Manager via registry modification

Downloads MZ/PE file

Downloads PsExec from SysInternals website

Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

Executes dropped EXE

Modifies Windows Firewall

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.