The malware modifies registry settings to maintain persistence, ensuring it survives system reboots. The modification was detected in the Windows registry, where a new startup key was added pointing to a malicious executable.