Malware Behavior Classification

Sandbox analysis shows these behaviors:

[+] Process: sample.exe (PID 2847)
[+] Mutex created: Global\{8F14E45F-CEEA-4F6A-A42E}
[+] File created: C:\Users\Public\svchost.exe (copy of self)
[+] Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate
[+] Network: TCP connection to 185.143.XX.XX:443 (TLS)
[+] API Hooks installed: NtQuerySystemInformation, NtOpenProcess
[+] Memory scan: Found AES-256 key material
[+] Disk activity: Scanning all drives for files matching *.doc, *.pdf, *.xlsx
[+] File activity: 847 files renamed with .encrypted extension
[+] New file: C:\Users\Public\README_RESTORE.txt

Based on the COMPLETE behavior profile, what is the PRIMARY classification?