Technical intelligence and weaponization dossier for CVE-2010-1885. Documented exploitation across 2 active malware families totaling 239 analyzed telemetry samples.
| Vulnerability ID | CVE-2010-1885 |
|---|---|
| Common Name / Bulletin | Microsoft Windows Help and Support Center HCP Protocol Handler RCE (MS10-042) |
| CWE Classification | CWE-94: Code Injection via URI Scheme |
| Affected Software & Versions | Microsoft Windows XP, Windows Server 2003 |
| Technical Root Cause | Vulnerability in Help and Support Center when interpreting hcp:// protocol URIs containing malicious escape characters, allowing script injection into the trusted local zone. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 2 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| spyeye | Banking Trojan | 192 | SpyEye (cataloged across security vendors as Trojan:Win32/SpyEye, Win32/SpyEye, and TSPY_SPYEYE) is one of the most notorious and commercially successful bankin... |
| kelihos | Spam Bot | 47 | Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in... |
Threat intelligence confirms the following adversaries weaponize CVE-2010-1885 in enterprise intrusions and campaign toolkits:
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2010-1885 in enterprise networks:
Process execution of helpctr.exe with parameters containing url=hcp:// or escaped script strings; browser redirection to hcp:// schemes.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Active Incident Response Playbook →