The ransomware modifies registry keys to establish persistence, allowing it to reload automatically when the system is restarted. This modification is an indication of a sophisticated persistence mechanism used by the attacker to ensure their malware remains active even after system reboots.