{
  "family": "2345cn",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\n2345cn (often associated with the 2345 Explorer or Hao123 suite) is a highly aggressive Chinese-origin Browser Hijacker and Adware family. While sometimes bundled as legitimate \"browser optimization\" or portal software in East Asian markets, its behavior in Western environments is explicitly malicious. It forcibly takes over all installed web browsers, rendering them nearly unusable for standard navigation in order to drive traffic to 2345.com and its affiliates.\n\n<h3>Distribution and Technical Behavior</h3>\n2345cn is primarily distributed via aggressive software bundling in \"grey market\" software installers or localized freeware downloads.\n\nOnce installed, 2345cn employs extreme persistence mechanisms to lock the browser configuration:\n<ul>\n<li><strong>Deep Browser Hijacking:</strong> The adware forcibly changes the homepage, default search engine, and new tab behavior to `2345.com` across Chrome, Firefox, Edge, and IE.</li>\n<li><strong>Shortcut Poisoning:</strong> To prevent users from changing their homepage back, 2345cn alters all browser `.lnk` shortcut files on the Desktop, Start Menu, and Taskbar, appending the `2345.com` URL as a mandatory launch parameter (e.g., `chrome.exe http://2345.com`).</li>\n<li><strong>Registry and Policy Lockdown:</strong> The malware often deploys Windows Group Policy Objects (GPOs) and deeply nested Registry keys to lock the browser settings, preventing the end-user (even those with administrative privileges) from reverting the changes via standard UI menus.</li>\n</ul>\n\n<h3>Risk Assessment</h3>\nA 2345cn infection results in a severe loss of user productivity and a total compromise of browser privacy. Because it intercepts all web traffic and operates with elevated persistence, it can also act as a vector for secondary malware infections if the affiliate networks it utilizes begin serving malvertising.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Shortcut Remediation:</strong> Manually inspect the `Properties -> Target` field of all browser shortcuts and remove the appended 2345 URLs.</li>\n<li><strong>Registry and GPO Sweep:</strong> Anti-malware tools must be used to locate and delete the specific Registry keys and unauthorized Group Policies established by the adware.</li>\n<li><strong>Browser Reset:</strong> A complete, factory reset of all installed browsers is required after the core executables and persistence mechanisms have been removed.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "BrowserModifier:Win32/2345cn",
    "Adware.2345",
    "PUP.Hao123"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1547.009",
    "T1112",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:09:54Z",
  "type": "Browser Hijacker",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}