This question already has an answer here:
Ransomware is injected as a script which encrypts all the data and requires a ransom from us.
We don't have to open the script to execute it. It is self-executing.
How it will be able to access and encrypt all files without admin privilege?
Police ransomware is also notable for infecting user32.DLL, a known critical file. Infecting a critical file can be considered an evasion technique as it can help prevent detection by behavioral monitoring tools due to whitelisting. Additionally, cleaning critical files such as user32.DLL requires extra care as one misstep can crash a system, which could be seen as a possible obstacle for cleaning tools.
The infected user32.DLL performs a chain of routines that ends with the ransomware being loaded. It also locks the infected computer's screen and projects a “ransom” image, similar to previous police ransomware messages.