Just go to your google junk mail bin and detonate all the attachments in VM with Wireshark on.
A lof of the lures are macro-enabled docs that actually POLITELY ASK the victim to enable macros. I wrote a Python script using oletools to extract the VBA from from these docs, then insert the VBA into a new doc, comment out all the AutoRun and Shell lines, and step through it.
You'll see callbacks, the location of the instructions its pull, as well as what the file names itself and its path.