There are couple of ways that I could think of.
First off, you could use Cuckoo Sandbox. It is an automated malware analysis system. It is open source and its modules are written in Python. To quote the website:
Malware! Tear it apart, discover its ins and outs and collect actionable threat data. Cuckoo is the leading open source automated malware analysis system.
Pretty exciting, isn't it? I believe, it will capture dropped files by default. Once a malware sample is submitted to Cuckoo Sandbox and analysis is completed, user gets analysis report. Certain sub-directory of the analysis report will contain files Cuckoo was able to dump. For more information check out Cuckoo's Analysis Result page.
In addition, you could create your own custom module to process dropped files. What are processing modules? Per Cuckoo Doc Website:
Cuckoo’s processing modules are Python scripts that let you define custom ways to analyze the raw results generated by the sandbox and append some information to a global container that will be later used by the signatures and the reporting modules. You can create as many modules as you want, as long as they follow a predefined structure...
I am pretty sure there are other automated sandboxes out there as well. However, you have to remember, there is no 100% guarantee a sandbox will process your malware just the way it would execute in real life environment.
Second method. You really need to know HOW dropped files are deleted for this method to work. I have already mentioned it in the comments above. You could also patch your executable. Let's say DeleteFile() is used. If patching malware is not an option, you could hook DeleteFile() function system wide. It is standard Windows API used to delete a file. This function is exported by Kernel32.dll. There is a lot written about system wide or global hooks and ways to accomplish it. I will not go in details about it here. However, there is one thing worth mentioning, you have to make sure you "trick" malware into "thinking" file is indeed delete by returning appropriate values. That's why, there could be a problem with using ACL directly. What if malware checks a return of DeleteFile() (or whatever it uses to delete the dropped file), and gets ERROR_ACCESS_DENIED? It might very well divert it from the regular "desired" execution path.
In addition, there are debuggers out there, that you help you make this process rather semi-automated. To mention few: Immunity Debugger by Immunity Inc. It employs very well supported Python API for automation and scripting. There are other option out there as well.
What I would like to mention at the end is that you are absolutely right. You might need to look into creating a little tool of your own. There is no "one-fits-all" solution. Some automated solutions might work better then others. From time to time you will have to dig in. Remember, getting your hands "dirty" gives you great and in-depth understanding of things happening behind the "curtain". I personally love such an involvement, and find it to be a really great learning experience.