The error message itself is pretty self-explanatory. You have to change your password before you'll be allowed to log in. WinSCP doesn't have a way do deal with interactive commands (that is, those that display something, then you type something, then they display something, ... etc).
Log in with PuTTY (so you get a TTY), change your password as required, then logging in with WinSCP should work.
Log in with PuTTY (so you get a TTY), change your password as required, then logging in with WinSCP should work.