Like OpenSSH and PuTTY, WinSCP can also be configured to use a proxy host.  Note that recent versions of Windows include or have OpenSSH available to install, which could be used instead of WinSCP, following the OpenSSH instructions.  The WinSCP example below uses WinSCP version 6.5.5.

In the Login dialog, select Advanced....

Under Connection, select Tunnel.  Check Connect through SSH tunnel, enter login.jlab.org. and your CUE username for Host name and User name, and click OK.

Then, back in the original Login dialog, enter ifarm and your CUE username for Host name and User name, and click Login.

Check that the fingerprint matches and Accept the key.

Authenticate with your two-factor credential (PIN and OTP),

and then with your CUE password in the second prompt,

after which you should find yourself logged in successfully.