The malware establishes persistence by modifying registry entries, allowing it to survive system reboots and maintain a foothold within the network. The registry key associated with the malware was altered to execute the malicious binary during startup.