diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 266896ab..5a1cddfd 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -13578,6 +13578,9 @@
       "meta": {
         "refs": [
           "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/fake-windows-update-spam-leads-to-cyborg-ransomware-and-its-builder/"
+        ],
+        "extensions": [
+          ".777"
         ]
       },
       "uuid": "0a0b9311-8cbc-4d97-b337-42c9a018ebe0",