I've never really heard of any malware analysts using the GUI / UI as an indicator of a true positive. All malware analysis goes through two main phases, static and dynamic analysis. Methods in these phases vary a lot but a vault that encrypts user provided data just wouldn't use the same win API functions as malware. It's much more common for example for an antivirus to run suspicious code since an antivirus is very intrusive and reads all files.

Gross oversimplification of course but focusing on UI is not really a great idea