UpNorth - this is a good learning opportunity for everyone on this forum. Thank you for the comment about video screen recording.
This particular Ryuk bundle was done per request of a client. It had a privilege escalation exploit and virtualization detection. The ransomware caused our Camtasia recordings to be corrupted, even when we ran in a privileged state. Due to virtualization detection, it was fastest to use a physical device. From time to time, we have to put a webcam in front of a physical device to record malware (not just ransomware).
At other times, we do see other features and configurations in ransomware, and would be glad to continue to share and educate.