1. A computer-implemented method for analyzing suspected malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a file suspected of including malware; determining that the file is configured to perform an attack on an external computing system that belongs to the same network as a computing system on which the file is configured to execute by: performing a static analysis of the file to identify at least one indication that the file is configured to perform an attack on the external computing system; and obtaining, from at least one additional computing system that was previously targeted by the file, telemetry data that identifies at least one indication that the file previously attempted to attack an additional external computing system that belonged to the same network as the additional computing system, wherein obtaining the telemetry data comprises: querying, using information that identifies the file, a telemetry database that associates file information with telemetry data, the telemetry database comprising information for the file collected from the additional computing system that was previously targeted by the file; and receiving, in response to querying the telemetry database, telemetry data for the file; constructing, using the indications obtained from the static analysis and the telemetry data, an execution profile that describes an execution environment that provides a virtual instance of the external computing system; and configuring the execution environment described in the execution profile to test the file for maliciousness.