The threat of ransomware to the software ecosystem has become increasingly alarming in recent years, which has raised a demand for large-scale and comprehensive ransomware analysis to help develop more effective countermeasures against unknown attacks. In this paper, we first collect a real-world dataset, consisting of 7,796 active ransomware samples, and analyze their behaviors of disrupting data in victim systems. All samples are executed in isolated testbeds to collect all perspectives of six categories of runtime behaviors such as API calls, I/O accesses, and network traffics, and the volume of total logs is up to 1.98 TiB. By assessing collected behaviors, we present six key findings throughout data reconnaissance, data tampering, and data exfiltration phases of ransomware. Based on our findings, we propose three corresponding mitigation strategies to detect ransomware during each of these phases. Experimental results show that they can enhance the capability of state-of-the-art anti-ransomware tools. We report a preliminary result of a 41%-69% increase in detection rate with no additional false positives, showing that our insights are useful.