No not really, the malware or ransomware can actually do it's work without gaining admin privileges just as an ordinary user.
Apart from that, the malware or ransomware uses known exploits like that of the NSA exploits which got leaked by the Shadow Brokers group, likewise we have examples - the WannaCry malware which took the world by surprise with a huge number of infected computers actually exploited the Eternalblue exploit which makes use of a vulberability in the Windows SMB Relay. Now the ransomware went on to encrypt the user's valuable files.
Rooting or gaining admin privileges part
So, more often ransomware mainly target known exploits, so yes even I can develop a malware which can target unpatched Windows systems and further if I want gain root access to perform something more malicious. For an example, my friend and fellow researcher SandboxEscaper disclosed an alpc LPE bug in Windows earlier this week, we can actually implement it in the malware to gain Local Privilege Escalation after making an user download an executable or malware we develop and perform more malicious actions on the system. But rooting or gaining admin privileges isn't always required.
Bottom line : Ransomware uses specific known exploits and to target a specific level of damage might as well chain Remote bugs with LPE to widen its impact but, this isn't usual since it can encrypt files with normal user privileges