.ryk files are getting created in temp folder with VS

Question

.ryk files are getting created in temp folder with VS

Rajlakshmi Baurai 6

Microsoft visual studio is triggering a custom IOA rule because it is creating files with random 8 character names and the extension .ryk in the folder %userprofile%\AppData\Local\Temp\1* location. On checking the file path it found to be on Appdata local temp loaction.

This is happening with Microsoft.ServiceHub.Controller.exe launched from Microsoft Visual Studio

I need to know if these temporary files are created by Microsoft Visual studio as part of its normal operation, as the extension .ryk is used by the Ryuk ransomware for the encrypted files. Though after investigating there is no suspicious activity observed. i want to validate this information from Microsoft itself.

Tianyu Sun-MSFT 34,436 Reputation points Microsoft External Staff

2022-06-30T07:48:00.643+00:00

Hi @Rajlakshmi Baurai , welcome to Microsoft Q&A forum. I don’t see the same behavior on my side, nor I find any created .ryk file in the %userprofile%\AppData\Local\Temp folder. Did you install some other applications or extensions which may create this file?
Rajlakshmi Baurai 6 Reputation points

2022-07-01T06:20:24.583+00:00

Hi @Tianyu Sun-MSFT Thank you for your response. In our environment we did not install any other applications or extensions. . we are receiving this alert triggered for multiple users. After examining the process the parent process found to be Microsoft Visual Studio and due to that .ryk file is getting created on temp folder along with the other files.
RLWA32 49,536 Reputation points

2022-07-01T12:00:35.753+00:00

So have you scanned the system with more than one AV to determine if the system has been compromised?
Rajlakshmi Baurai 6 Reputation points

2022-07-01T12:05:46.843+00:00

Hi @RLWA32

yes we did that. We have checked the network connections it was towards safe IPs and domains. We have investigated the host but couldn't find any other suspicious activity.
RLWA32 49,536 Reputation points

2022-07-01T12:21:06.67+00:00

I'm just curious -- how did you determine that Microsoft.ServiceHub.Controller.exe was the process that created the .ryk files?
Rajlakshmi Baurai 6 Reputation points

2022-07-01T12:47:25.07+00:00

we have created a custom rule in our EDR system which detects the creation of ransom note RyukReadMe and the encryption process of Ryuk Ransomware where the file extension of .RYK/.Ryuk is appended to the file.

And as I have mentioned in my original question we have received an alert triggered for the process Microsoft.ServiceHub.Controller.exe
RLWA32 49,536 Reputation points

2022-07-01T13:18:18.857+00:00

FWIW, I haven't seen any .ryk files created in the user profile temp files location by either VS2019 or VS2022.
Venkatesh Konar 0 Reputation points

2023-11-10T03:48:14.4133333+00:00

Not only with Microsoft.ServiceHub.Controller.exe there are other service like devenv.exe and other service path are also creating temp files with .ryk and other three letter random extension files. As these files are temporary and get purged . We are unable to analyze the file on security point of view. So we trace down the process responsible for creating the temp files , the process found to be legitimate processes used in Visual Studio.
Tianyu Sun-MSFT 34,436 Reputation points Microsoft External Staff

2023-11-10T07:53:26.7433333+00:00

Hello @Venkatesh Konar ,

Do you mean the files with .ryk extension will be created, or the folders which have .ryk in their name will be created by VS?

Sounds it’s a file not a folder, and it will be created and removed before you can catch and check it.

VS does create some folders with random characters in %Temp% folder for temporary storage and caching, here are some descriptions: Please keep my TEMP folder clean, Visual Studio Installer Filling Temp Folder. These files are not harmful to your machine.

I checked on three machines with VS 2022/VS 2019 installed, but I didn’t find any .ryk files. Perhaps some Windows tools are needed to help record the behavior/events to investigate further. Could you please submit a ticket(open VS > click Help > Send Feedback > Report a Problem…) on our Developer Community with related screenshots attached?
Venkatesh Konar 0 Reputation points

2023-11-11T14:00:03.92+00:00

Dear Tianyu Sun , Thanks for the respose.

I would like to clarify that no folder with .ryk extensions are created. But random file with .ryk extensions are generated by VS code process or services (not sure ) are observed in Temp folder as well as other folder related to VS code.

Also you are right ! Those file with .ryk extensions and other files with random extensions are removed and we were unable to access the files. As they are like temporary file which might have generated during run time.

Also occurrence of the random file with .ryk extensions are also random and our observed in different system where user uses the Visual Studio Software.

One thing i found common during analysis is that the parent process or the process responsible for creating the random (temporary ) file with .ryk extensions had legitimate process related to Visual Studio.

I need some time to arrange the evidences and will raise a ticket as mentioned in the above comment.

Your answer

Tianyu Sun-MSFT 34,436 Reputation points Microsoft External Staff

2022-06-30T07:48:00.643+00:00

Hi @Rajlakshmi Baurai , welcome to Microsoft Q&A forum. I don’t see the same behavior on my side, nor I find any created .ryk file in the %userprofile%\AppData\Local\Temp folder. Did you install some other applications or extensions which may create this file?
Rajlakshmi Baurai 6 Reputation points

2022-07-01T06:20:24.583+00:00

Hi @Tianyu Sun-MSFT Thank you for your response. In our environment we did not install any other applications or extensions. . we are receiving this alert triggered for multiple users. After examining the process the parent process found to be Microsoft Visual Studio and due to that .ryk file is getting created on temp folder along with the other files.
RLWA32 49,536 Reputation points

2022-07-01T12:00:35.753+00:00

So have you scanned the system with more than one AV to determine if the system has been compromised?
Rajlakshmi Baurai 6 Reputation points

2022-07-01T12:05:46.843+00:00

Hi @RLWA32

yes we did that. We have checked the network connections it was towards safe IPs and domains. We have investigated the host but couldn't find any other suspicious activity.
RLWA32 49,536 Reputation points

2022-07-01T12:21:06.67+00:00

I'm just curious -- how did you determine that Microsoft.ServiceHub.Controller.exe was the process that created the .ryk files?
Rajlakshmi Baurai 6 Reputation points

2022-07-01T12:47:25.07+00:00

we have created a custom rule in our EDR system which detects the creation of ransom note RyukReadMe and the encryption process of Ryuk Ransomware where the file extension of .RYK/.Ryuk is appended to the file.

And as I have mentioned in my original question we have received an alert triggered for the process Microsoft.ServiceHub.Controller.exe
RLWA32 49,536 Reputation points

2022-07-01T13:18:18.857+00:00

FWIW, I haven't seen any .ryk files created in the user profile temp files location by either VS2019 or VS2022.
Venkatesh Konar 0 Reputation points

2023-11-10T03:48:14.4133333+00:00

Not only with Microsoft.ServiceHub.Controller.exe there are other service like devenv.exe and other service path are also creating temp files with .ryk and other three letter random extension files. As these files are temporary and get purged . We are unable to analyze the file on security point of view. So we trace down the process responsible for creating the temp files , the process found to be legitimate processes used in Visual Studio.
Tianyu Sun-MSFT 34,436 Reputation points Microsoft External Staff

2023-11-10T07:53:26.7433333+00:00

Hello @Venkatesh Konar ,

Do you mean the files with .ryk extension will be created, or the folders which have .ryk in their name will be created by VS?

Sounds it’s a file not a folder, and it will be created and removed before you can catch and check it.

VS does create some folders with random characters in %Temp% folder for temporary storage and caching, here are some descriptions: Please keep my TEMP folder clean, Visual Studio Installer Filling Temp Folder. These files are not harmful to your machine.

I checked on three machines with VS 2022/VS 2019 installed, but I didn’t find any .ryk files. Perhaps some Windows tools are needed to help record the behavior/events to investigate further. Could you please submit a ticket(open VS > click Help > Send Feedback > Report a Problem…) on our Developer Community with related screenshots attached?
Venkatesh Konar 0 Reputation points

2023-11-11T14:00:03.92+00:00

Dear Tianyu Sun , Thanks for the respose.

I would like to clarify that no folder with .ryk extensions are created. But random file with .ryk extensions are generated by VS code process or services (not sure ) are observed in Temp folder as well as other folder related to VS code.

Also you are right ! Those file with .ryk extensions and other files with random extensions are removed and we were unable to access the files. As they are like temporary file which might have generated during run time.

Also occurrence of the random file with .ryk extensions are also random and our observed in different system where user uses the Visual Studio Software.

One thing i found common during analysis is that the parent process or the process responsible for creating the random (temporary ) file with .ryk extensions had legitimate process related to Visual Studio.

I need some time to arrange the evidences and will raise a ticket as mentioned in the above comment.

Share via

.ryk files are getting created in temp folder with VS

Your answer