Some malware even has anti-sandbox these days, along with anti-VM, anti-debug, and anti-heuristics. Therefore, the only real way to test these things is using something like Deepfreeze. It works extremely well.