The zip attachment of the "PURCHASE ORDER" email contains a bat file. This runs a PS, which infects the machine with malware. The stolen data is exfiltrated via SMTP.
Syria, Iran seeks to expand its influence to Hasaka and Qamishli

Iran seeks to expand its influence in Hasaka and Qamishli with recruiting and building purchases
Iran has launched a series of actions aimed at Hasaka and Qamishli to increase its influence in the Syrian region. The Afghan Fatmoun Brigade has just launched recruiting operations in the two cities, both among civilians and local groups. Furthermore, as the Syrian Observatory for Human Rights (SOHR) reports, there has been a boom in property purchases in the quadrant by pro-Tehran factions. Moreover, these (at least 35) would all be in areas controlled by the Damascus regime. This, although there is no official confirmation, seems to be linked to the fact that among the “targets” of the recruitments there are numerous members of the National Army (SAA).
Tehran’s strategy in Syria is based on three pillars
Iran has long started a strategy, based on three pillars, to expand its presence in Syria. The first is the recruitment campaigns in Deir Ezzor, east of Aleppo and now in Hasaka and Qamishli. All use the leverage of benefits such as free access to medical care at facilities used by pro-Tehran and other militias. The second are new military bases between Raqqa, Homs and Aleppo. Finally, the last pillar is the economic-real estate one. Pro-Iranian companies have acquired contracts in strategic sectors such as water supplies. At the same time, the Shiite militias or their intermediaries began to acquire land and buildings en masse, even destroyed. First only near the border with Lebanon. Then, also to the East in Kurdistan.