Can malware have its own GRUB/boot-loader and use it to be active?

I use Ubuntu 16.04. After I mounted an ISO which may or may not have had malware in it, my system sometimes ends up showing a blank screen after logging into Ubuntu or reboots a minute or two after I log into Ubuntu or like today, when it reached the Grub screen and rebooted. Then it reached the Grub screen and rebooted again. The third time I reached the Grub screen and the countdown for automatic selection of OS was counting down from 25 seconds. This was unusual because I had set the countdown to 10 seconds. I disconnected my smart-phone from the USB port of the computer, hard-rebooted again, and this time the Grub countdown was at 10 seconds and no problem happened. I've had my phone connected like this to the computer for two months and I've not observed any odd behaviour, so I'm ruling out that the Android phone could be the cause. However, since the Grub timeout was at 25 seconds, I was wondering if there could be a malware that installs its own GRUB and randomly chooses to boot from it, thereby granting itself root privileges in some way. Is this possible or am I just being paranoid? P.S. I should also mention that this problem of the computer restarting used to happen three months ago, which I think is approximately the time I mounted the same ISO file in Ubuntu. I had wiped the hard disk and reinstalled the OS suspecting an infection. But I thought the infection might have come from a pen drive I inserted into a friend's computer. It's only now I suspect that the restarts could be related to that ISO.
http://dlvr.it/S05LqH