In the ever-evolving world of digital security, protecting our data with cryptographic functions has become paramount. However, it's a double-edged sword, as cybercriminals commonly use cryptographic functions in malicious software, such as ransomware. The motive behind this study is rooted in the critical need to improve early detection methods for ransomware, which heavily utilises cryptographic functions to encrypt victim data. Automated static analysis techniques for identifying such functions within binary executable files remain under-explored and are of great importance. Our methodology involved a detailed manual static analysis of ransomware samples, explicitly focusing on Portable Executable (PE) files and the AES cryptographic function. We utilised tools like IDA (Interactive Disassembler) to examine import function tables, constant values in data sections, and specific processor instructions indicative of cryptographic operations. By analysing these components, we identified the presence of AES encryption in various ransomware samples through several methods. Our findings highlight effective strategies for detecting AES encryption through static analysis, such as locating Rijndael S-Box structures, identifying specific API calls related to encryption, recognising hardwareaccelerated AES-NI instructions, and finding explicit mentions of AES in textual constants. Our research thoroughly explored this problem, found suitable automatable solutions, and highlighted their advantages and limitations. These validated methods demonstrate significant potential for future automation in ransomware detection systems. Automating these detection techniques could provide early warnings to users about potential threats, offering a proactive defence mechanism against ransomware aRacks.