Perhaps you don't need ransomware to demonstrate what happens. You could fake the output of the attack using openssl like this:
openssl aes-256-cbc -pass pass:pwd -in victim -out victim.ransom && rm victim
openssl aes-256-cbc -pass pass:pwd -d -in victim.ransom -out victim
However, it looks like you may be more interested in demonstrating the activity of the ransomware file system scanner, to prove that your isolated VM can't encrypt the files of the host system or of other guest systems. That's rather like proving a negative. The best demonstration might be to show how find works, because that's exactly what ransomware would have to do.
Create a file named
/tmp/sacrificial_pic_<vmname>.jpg on each of the VMs, including the VM hosting the fake malware, substituting the machine name in the filename above. Run the find command on the VM hosting the fake malware, like this:
find / -name \*.jpg -print
This will emulate the activity of malware searching for picture files to encrypt. The only sacrificial JPG your find command should discover is the one on your local VM.