The attacker generates a key pair and places the public key in a piece of malware.
When the malware is released on a computer, it generates a random symmetric key and encrypts the victim's data with it. It uses the public key in the malware to encrypt the symmetric key.
The malware displays a message to the victim with instructions about how to pay the ransom.
When the victim sends the e-payment, the attacker deciphers the asymmetric ciphertext using the private key from the key pair, and sends the symmetric key to the victim, who uses it to decipher the encrypted files.