Government investigators and private cybersecurity firms are trying to find out how a virus managed to spread around the globe over the weekend, which would give them their best chance to identify the mastermind behind the cyberattacks.

Investigators have already ruled out phishing—tricking someone into opening a seemingly legitimate email attachment that actually contains the virus—as a possible tactic. One of their hypotheses centers on something called port 445, an outlet that isn’t supposed to be connected to the internet....