Our company was hit with this one on Monday. Unfortunately, we use older software that requires macros for document merging,
leaving us vulnerable to this type of attack. One of my users received an attachment and opened it, apparently. We caught it less than an hour after it starting doing it’s work, but the damage was done, over 20,000 files encrypted. It searches mapped drives and searched the network for open Shared Folders (not mapped). We were able to restore everything from backups, which, besides prevention, is the only defense. I even created a Group Policy to stop older ransomware (Cryptolocker) that prevents anything executing from C:\Users\USERNAME\AppData\, but it didn’t stop this one. This creates a file in C:\Users\USERNAME\AppData\Local\Temp\RANDOMSTRING.tmp and puts registry entries to execute this file at startup. There was
another registry entry on the system in BINARY that I assume helps this file.