Martha Zerehi said the 13-year-old boy was shot and then pretended he had been killed to fool the gunman into not firing again.
"He played dead to live," said Zerehi, adding the suspect "thought he killed everybody."
Three people were killed in the incident Wednesday at United States Fire Protection Services and a nearby residence in Downey, south of Los Angeles.
Family members believe Jade Douglas Harris, 30, went to the address to steal a car offered for sale on the Internet, although police have not released any information on a potential motive, the Los Angeles Times said Sunday.
The boy was identified as the son of Susana Perez -- a member of the family that owns the business -- who died in the shooting spree. Harris is also accused of killing two employees -- Josimar Rojas, 26, and Irene Cardenas, 35.
The 13-year-old boy was reported recovering from a head injury in a hospital.
Maria Fuentes, 52, a family member, was recovering in a hospital from wounds to her face and hand, a lawyer for the family said.
Harris was being held in the Los Angeles County jail on suspicion of murder and non-negligent manslaughter.