Rantest

Overview

Ransom:Win32/Rantest is generally a heuristic classification for a test file, a proof-of-concept (PoC), or a benign simulator designed to mimic the behavior of destructive ransomware. It is frequently used by security vendors, SOC analysts, and penetration testers to safely evaluate the efficacy of Endpoint Detection and Response (EDR) solutions and behavioral blockers without risking actual data loss.

Understanding Ransomware Simulators
To an end-user, a Rantest file might generate a scary antivirus alert, but it will not actually encrypt their files. For a SOC analyst, a Rantest detection is usually a benign true positive—the security tool correctly identified ransomware-like behavior (e.g., rapid file enumeration and modification), but the intent of the software was testing, not extortion. However, analysts must always verify the origin of the file to ensure it is not a novel, fully weaponized threat misclassified as a test.

Execution and Simulated Extortion Mechanics
Rantest files are executed intentionally by security personnel (`T1204.002`). Upon execution, the simulator will mimic the kill chain of modern ransomware. It may execute commands like `vssadmin.exe delete shadows` to test if the EDR blocks shadow copy deletion (`T1490`). It will then rapidly iterate through a designated test directory, opening files, reading the contents, encrypting them in memory, and writing them back to disk with a new extension (like `.test`) (`T1486`). A high-quality simulator will also attempt to mimic the process hollowing or injection techniques (`T1055`) used by real ransomware to evade initial detection, providing a comprehensive test of the endpoint's behavioral analysis engine.

Indicators of Compromise & Impact
The impact should be zero (if run in a controlled test environment). Host-based IoCs mirror actual ransomware: spikes in CPU and disk I/O, rapid file renaming, and EDR alerts for mass file modification. The critical difference is the context of execution (run by a known administrator in a test folder) and the ability to cleanly reverse the encryption.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_RANTEST_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Rantest"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "rantest" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Rantest (Ransomware) Execution & Triage
id: 5094bb66-2a94-5b41-a4d3-c3290fc51cb7
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Rantest malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/rantest
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1486
- attack.t1490
- attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_RANTEST_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Rantest tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "rantest" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Verify the context of the alert; if the executable was run by a member of the security team during an authorized test, log the EDR's successful block or detection and close the incident.
2. If the alert triggered on a standard user's workstation without authorization, treat it as a potential live ransomware incident until proven otherwise.
3. Isolate the machine and capture the executable for static analysis to confirm it is a benign simulator (like KnowBe4's RanSim) and not a live variant of Conti or LockBit.
4. Review the EDR telemetry to ensure the simulator did not actually modify critical user data outside of the designated test boundaries.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not ignore the alert simply because it contains 'test' in the name; threat actors occasionally name their malware benignly to trick analysts.
2. Avoid running ransomware simulators on production endpoints without explicit authorization and a fully tested backup recovery plan.

References & External Analysis

• Search "rantest" on VirusTotal (External Analysis)
• Search "rantest" on Any.Run (Sandbox Sandbox)
• Search "rantest" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Babonock
• Badjoke
• Hermes
• Scriptkd
• Sysupdate
• Jaike
• Iczu
• Sanctionedmedia

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/rantest.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.