Patchwork modifies the Windows registry to maintain persistence, ensuring their backdoor remains active even after system reboots. The registry key associated with the backdoor was altered to execute a malicious binary upon system startup.