If the malicious file is opened it will execute the virus payload, which is malicious code. The ransomware runs the code that encrypts user data on the infected computer or host. Find out more detail on how ransomware attacks happen.