Exchange server 2007, whether to extract the list who's opened, downloaded or executed

Question

Hi all,
With an Exchange server 2007 system and Outlook 2007 is used to have access to for the staff.
Is there any possible way to get the emplyee-list whom has opened, downloaded or executed the attached files in mails that are generally determined as the Ransom-ware files or Spear-phishings or spyware files in use's Inbox under the
Exchange server 2007 system.
Can anyone help provide me that Exchange server 2007 has such a monitoring & audit functionalities to retrive the user activities logs who has triggered the acctached files which are generally considered as the Ransom-ware files or Spear-phishings
or spyware files 
Your guide and tips would be appreciated in advance. Thanks and regards.

Answer 1

Thank you for your response and before I close this session, let me please ask you one more last question below.
According to your response above and provided that mailbox audit is set to be logged for all users, for example, and among mailbox actions as viewed as an image file below, what action log does that describe the attached files that have been whether to
be downloaded, executed( opened )?
Action
Description
Administrator
Delegate
Owner
Copy
An item is copied to another folder.
Yes
Yes
No
Create
An item is created in the mailbox. (For example, a message is sent or received.) Note that folder creation isn't audited.
Yes*
Yes*
Yes
FolderBind
A mailbox folder is accessed.
Yes*
Yes**
No
HardDelete
An item is deleted permanently from the Recoverable Items folder.
Yes*
Yes*
Yes
MessageBind
An item is accessed in the reading pane or opened.
Yes
No
No
Move
An item is moved to another folder.
Yes*
Yes
Yes
MoveToDeletedItems
An item is moved to the Deleted Items folder.
Yes*
Yes
Yes
SendAs
A message is sent using Send As permissions.
Yes*
Yes*
Not applicable
SendOnBehalf
A message is sent using Send on Behalf permissions.
Yes*
Yes
Not applicable
SoftDelete
An item is deleted from the Deleted Items folder.
Yes*
Yes*
Yes
Update
An item's properties are updated.
Yes*
Yes*
Yes
Further, would that all be availble from Exchange 2007 for the mail-box auditing function for the target of the  assumed ransomware files or spyware files triggered in a stored mail in Inbox?
Thanks and regards,
Lee, Peter Byoungki