TrendLabs: Emotet-Distributed Ransomware Loader for Nozelesn Found via Managed Detection and Response

Figure 2. PowerShell script that shows it connecting to various IP addresses and creating 942.exe

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-distributed-ransomware-loader-for-nozelesn-found-via-managed-detection-and-response/