I expect this is very much on a per malware and OS basis so could potentially be very broad hence the typical.
A user's computer has been infected by a piece of malware which aims to encrypt all their files to extort money. Obviously it's not going to encrypt everything as the computer will need to remain operation in order to try exploit money from the end user and reduce risk of detection whilst in operation.
How does the ransomware know what's safe to encrypt without accidently 'shooting itself in the foot'.
- Does it go for certain 'typical' folders say ${userhome}\pictures|music|documents|etc.
- Does it go for certain expected file types, e.g. doc|jpeg|mp3.
- Does it go for everything except certain folders (e.g windows or program files).
Also what happens if there are multiple drives (so SSD for programs and OS, HDD for files and network drives for shared programmes/files etc) or if programs are not stored in the typical places?
I know at the end of the day the attacker doesn't care if they brick a victims machine, but surely if they were to brick every machine then they wouldn't be able to extort money thus bypassing the whole ransom aspect. (The obvious answer being they expect average users just to follow the same default folder structures).