During malware analysis, an analyst detonates a suspicious executable in a sandbox. The behavioral report shows the sample creates a scheduled task, writes to the Run registry key, injects code into explorer.exe, and beacons to an external domain every 60 seconds. Before writing the final report, the analyst wants to classify the sample's primary threat behavior to prioritize the response. Which observed behavior most directly indicates the sample's persistence mechanism?