you should first provide additional proof that this is indeed related to Wannacry malware. i did a quick reverse search and i couldn't find any information on that address.
It looks like it's paying to many addresses, each of which I suspect is owned by a single person. Criminal enterprises have many members each of whom has a role. Those smaller 0.01BTC payments look like commissions to members while the two whole BTC payments looks like contracting money to two different people for each to independently do their dirty work.
you have built up the size of the scam in your head, it is nowhere near that big to be called a "criminal enterprise"

if it is indeed related to that scam, then it simply looks like the attacker is mixing his coins. considering the fact that nearly all the outputs are already spent, there is a good chance that many of them belong to different services. like using a quick exchange service, a gambling site, mixers,...