You can try to use a text editor to insert lines that calls to MsgBox with some variables to print their contents, in order to de-obfuscate the script and understand it's logic.
Also there is probably a WMI query that enumerates some hardware or BIOS etc. to identify it is running in a virtualized environment.
Since WMI Query in VBS are done by first running GetObject I would try to look for calls to GetObject and then MsgBox-ing their return values, or the return values in the next few lines following GetObject. Then after identifying that query there should be a condition that exits if some string is found in there which indicates a virtualized environment.
A second approach would be to look for a call to WScript.Shell and try to work your way backwards to where the file that was executed was written.
Another option that could be causing this not work in your VM, is that the script is downloading the malware form a remote server which is no longer available, although it worked in the online sandbox environment a while ago (while it was still available), in this case you might be lucky if you are able to extract the URL that the script tries to download from and look it up in google/VirusTotal etc.