A letter came with js inside, in which strange things happen, who knows what it is?

Question

Burglary protection

Today, a letter came to my work mail with a completely harmless content "Good day, We, for our part, understand that there is a crisis in the yard, but, nevertheless, my management proposes to sign the Reconciliation Act (see attachment) ...". I immediately noticed that the attachment with the js extension. I opened it in notepad, there are 3 files downloaded from a certain site - exe, bat and doc.
I couldn’t stop, it became very interesting what it was, raised the virtual machine, picked up the files (even tried to run exe and bat) and decided to write here, maybe someone knows what it is?
1. The bat file inside contains this text:

Google translate recognizes this as Chinese: "Yi Pen atonement for idling Liu Jiao pancakes."
How can bat be in Chinese? Is it encrypted with something or scripts can be written in different languages??
2. doc file when opening:

Again Chinese and it is not clear at all what it is and why.
3. When you run the exe, the GnuPG library is downloaded.

Who knows what this thread is? It became wildly interesting.
Thank you 27cm 27cm , that's what's in the batch file

Answer 1

The vault encryptor uses gpg, encrypts all *.doc, *.jpg files, mail, etc., creates a pair of keys and sends its own to scammers, after which it creates a text file with an offer to pay money in order to get the key and decrypt the files. The price of the issue is from 50 to 1000 dollars, a site of scammers in the Tor network. When my users caught this infection, I contacted Casper and Nod32, they confirmed that there was no cure and would not be for a long time, and the virus itself was not detected by antiviruses. So be careful and do explanatory work with users - this is the only way to avoid infection as much as possible.

Answer 2

And where can I write to block their site? I understand that they will register a new one, but at least do something, people will suffer from such tricks. It came to my corporate mail, managers would 100% open and launch it, I was lucky that I was the first to open the mail in the morning.