BIOS looks for a target device to boot from that contains a master boot record. The MBR's boot code uses the volume boot code of that specific partition to identify where the system partition is.

Its ability to modify the legitimate volume boot record makes it possible for the Nemesis components to load before Windows starts. That makes the malware hard to detect and remove using ...

“In early 2015, FIN1 updated their toolset to include a utility that modifies the legitimate system Volume Boot Record (VBR) and hijacks the system boot process to begin loading Nemesis ...