KeyBoy modifies registry keys to maintain persistence, ensuring their backdoor survives system reboots and remains hidden from basic security scans. Detected modification in registry to include malicious script for persistence.