I was checking sandbox and information on the killswitch link but the WannaCry does not do a DNS query. How does it call out?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I suppose it's best that I first answer the question. Then after, I'll elaborate a bit. Question: How does it call out? Answer: It calls out using DNS - as you did suspect. The WannaCry ransomware actually does multiple dns requests throughout its lifecycle. In the WinMAIN function of its code, it attempts to connect to the website with the url of iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com. The reason for that DNS request is suspected to be a "killswitch" for the author for use in either a sandbox test environment, or possibly a link to the CCS's (Command and Control Servers).
The other DNS request(s) are made to access the ToR network (aka Dark Web) so it can anonymously download the encryption program as well as access a bitcoin wallet to pay the $300 payment.
CITED SOURCES: WANNACRY CODE ANALYSIS - https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/