Modern ransomware is a hybrid of automated and manual processes. So, there is not a set of binaries to analyse to find the most common methods in an end-to-end attack. You have to be able to perform post-infection forensics to see the movement, and most of that data is private, so we get an incomplete picture.
However, there are two resources that will be helpful for your research:
MITRE ATT&CK
MITRE ATT&CK is a database and a tool to make sense of attacks. They have several different ransomware strains in their database that can allow you to see what techniques are used.
Here is the matrix for the Ragnar Locker ransomware loaded into the Navigator tool.
The Navigator tool is not intuitive to use, but you can load every ransomware in the ATT&CK database into the Navigator and count the commonalities, if you wanted to do that.
Note that the database is not comprehensive, and that ransomware, like all software, evolves quite quickly.
ATT&CK also has a database for threat groups and their techniques. You can use the navigator to research commonalities in approaches in the database.
Conti manual
Conti is a Ransomware-as-a-Service, and a disgruntled member released the group's operating manual. It outlines the group's recommended tools and techniques for lateral movement.
The problem for your research, though, is that the manual is opportunistic in its approach. Yes, it lists SMB, RDP, AD, anything with a HTTP login, etc. But it is entirely up to the human to discover and then successfully utilise the vector. The manual includes many recent vulnerabilities for the attacker to try, with the note "Fresh but known vulnerability. Use before patched".
Survivorship Bias in Research
What we get as researchers is just what worked and what was subsequently discovered by forensic analysts after the fact. We don't know what worked that was not also found. We can't make any hard and fast conclusions about what might have been tried by an attacker, or what order things were tried. Once some approach works, there is little need to try other approaches, even if they might have also worked.
So, for risk management and system\network defence design, it is far better to take a step back and look at the problem holistically. The fact of the matter is that there are common weak points in a system\network, and they will all be tested, eventually, by an attacker. Prioritise, perhaps, based on common findings, but certainly don't stop there.
Commonalities
All that aside, what we are seeing post-infection, is the gathering of AD admin credentials, tokens, and hashes. And if necessary, moving from system to system with gathered non-admin credentials to find a system that does have admin tokens/hashes. Then using that access to access the whole of the network. And that means SMB connections between computers in one form or another.
