As the previous two mentioned the malware wasn't connecting to the unregistered domain name. The unregistered domain was a technique that was supposed to be used to prevent analysis of the malware.
Often times when malware researchers are picking apart malware they do so in a virtual machine. The way certain virtual machines resolve domain names result in unregistered domain names being considered "resolved" to applications running on the VM. Advanced malware authors know this and so before they infect the machine they will often attempt to connect to random unresolved domain names. If these domain names get resolved then it signals to the malware that it is functioning on a virtual machine. If it detects this then it will abort and refuse to infect the machine. This makes analyzing the malware more difficult.
In the case of the WannaCry malware the author attempted to create a similar countermeasure, but did so incorrectly. He hard coded the unregistered domain names. So once the researcher pointed the hard coded domain name to a DNS sink all the infected computers thought they were infecting a VM. So instead of starting the encryption process the malware just exits to prevent further analysis.
Had the author randomized the domain name check, registering the domain name would have done nothing.