{
  "family": "rantest",
  "sample_count": 5,
  "category": "ransomware",
  "description": "Ransom:Win32/Rantest is generally a heuristic classification for a test file, a proof-of-concept (PoC), or a benign simulator designed to mimic the behavior of destructive ransomware. It is frequently used by security vendors, SOC analysts, and penetration testers to safely evaluate the efficacy of Endpoint Detection and Response (EDR) solutions and behavioral blockers without risking actual data loss.<br><br><b>Understanding Ransomware Simulators</b><br>To an end-user, a Rantest file might generate a scary antivirus alert, but it will not actually encrypt their files. For a SOC analyst, a Rantest detection is usually a benign true positive—the security tool correctly identified ransomware-like behavior (e.g., rapid file enumeration and modification), but the intent of the software was testing, not extortion. However, analysts must always verify the origin of the file to ensure it is not a novel, fully weaponized threat misclassified as a test.<br><br><b>Execution and Simulated Extortion Mechanics</b><br>Rantest files are executed intentionally by security personnel (`T1204.002`). Upon execution, the simulator will mimic the kill chain of modern ransomware. It may execute commands like `vssadmin.exe delete shadows` to test if the EDR blocks shadow copy deletion (`T1490`). It will then rapidly iterate through a designated test directory, opening files, reading the contents, encrypting them in memory, and writing them back to disk with a new extension (like `.test`) (`T1486`). A high-quality simulator will also attempt to mimic the process hollowing or injection techniques (`T1055`) used by real ransomware to evade initial detection, providing a comprehensive test of the endpoint's behavioral analysis engine.<br><br><b>Indicators of Compromise & Impact</b><br>The impact should be zero (if run in a controlled test environment). Host-based IoCs mirror actual ransomware: spikes in CPU and disk I/O, rapid file renaming, and EDR alerts for mass file modification. The critical difference is the context of execution (run by a known administrator in a test folder) and the ability to cleanly reverse the encryption.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact (Simulated)",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery (Simulated Shadow Copy Deletion)",
      "tactic": "Impact"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Simulated Evasion)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Verify the context of the alert; if the executable was run by a member of the security team during an authorized test, log the EDR's successful block or detection and close the incident.",
    "If the alert triggered on a standard user's workstation without authorization, treat it as a potential live ransomware incident until proven otherwise.",
    "Isolate the machine and capture the executable for static analysis to confirm it is a benign simulator (like KnowBe4's RanSim) and not a live variant of Conti or LockBit.",
    "Review the EDR telemetry to ensure the simulator did not actually modify critical user data outside of the designated test boundaries."
  ],
  "what_to_avoid": [
    "Do not ignore the alert simply because it contains 'test' in the name; threat actors occasionally name their malware benignly to trick analysts.",
    "Avoid running ransomware simulators on production endpoints without explicit authorization and a fully tested backup recovery plan."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}