"Marcus Hutchins obtained a WannaCry sample, ran it in an analysis environment, noticed an unregistered domain and registered it."
Hutchins's first-person account describes obtaining the malware sample, observing its domain query during analysis and promptly registering the domain.
View Source