Does a Wannacry-infected computer on an internal network with a private IP address attempt to spread to other privately-addressed subnets?
I have not found a definitive answer online.
The first thread checks the IP address of the infected machine and attempts to connect to TCP445 (SMB) of each host/IP address in the same subnet and second thread generates random IP address on the Internet to perform the same action.
Which implies that Wannacry only spreads within a subnet (public or private addresses) and to public IP addresses, so adjacent private subnets are safe.
The threat avoids infecting the IPv4 address if the randomly generated value for first octet is 127 or if the value is equal to or greater than 224, in order to skip local loopback interfaces.
This implies that Wannacry only discards loopback and multicast / reserved addresses. This would mean that a private IP address could be randomly generated and Wannacry could hop to another private subnet.