This is the login_username_password_incorrect lexicon key.
$_lang['login_username_password_incorrect'] = 'The username or password you entered is incorrect. Please check the username, re-type the password, and try again.';
If you edit the message with that key in the core namespace, login topic in Lexicon Management -- System (gear icon) -> Lexicons, it should replace the current message and will survive MODX upgrades.
Clear the cache after making any changes.