The Vcrodat malware has been observed manipulating registry keys for persistence. This is a known tactic of the Whitefly group to ensure continuous access to compromised systems. The malware modifies the registry key to execute a malicious payload upon system startup.