Script Analysis has no effect either way on the mechanism of action of this ransomware.
Also, to clarify what happens if you choose to add things to the Protected objects list in HIPS settings, one can certainly protect the entire drive as noted above, or one can just protect individual folders. For instance, just protecting the Pictures folder and running the ransomware file that I discussed above will result in a (red) HIPS popup that states a file is attempting to Modify a protected File or Folder; you will get this popup for EVERY file that is in that directory, and choosing just Block will not allow the ransomware to make any changes to these files.
On the other hand protect the Photos directory but NOT the Document folder and hit Block at all the HIPS prompts will result (as before) in all the Photos being unchanged but ALL the Documents will be encrypted.
Hope this helps,
m