Controlled Folder is shown to be active at 2:14. As to Shadow copies, a similar variant was shown to delete (vssadmin) them at the 1:30 mark of the AppCheck Overview video (and at 2:08 of that same video WF was shown to be disabled by the malware). And although it wasn't asked, at 1:16 of the Defender and VirusTotal video UAC alerted to Task manager starting which is only done with UAC at Max. UAC did not, however alert to the malware.
The Magniber usually deletes shadow copies. I assume that in your video in the OP the UAC was bypassed and files in the protected folders were encrypted without an alert. But still, we can see the Controlled Folder Access alert that svchost.exe was prevented from making changes to the memory.
-------------------------------------------------------------------------------------------------------------------
| Event ID: 1127 | |
|---|
| Symbolic name: | MALWAREPROTECTION_FOLDER_GUARD_SECTOR_BLOCK |
| Message: | Controlled Folder Access(CFA) blocked an untrusted process from making changes to the memory. |
| Description: | Controlled Folder Access has blocked an untrusted process from potentially modifying disk sectors. |
-------------------------------------------------------------------------------------------------------------------
Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors
docs.microsoft.com
Protection against modifying disk sectors is independent of protecting files in folders. The alert from the video strongly suggests that shadow copies were not deleted (protected by CFA). If not, then Magniber could also exploit the protected disk sectors (MBR, shadow copies, etc.).
