Crypto ransomware, as the name suggests, encrypts files on a hard drive. Not all ransomware behaves this way, but the vast majority does. The attacker promises to provide a decryption key in return for the paid ransom.